I'm having issues adding credentials to my code string. The purpose of this is to pull multiple logs and from a single machine and print out the logs in order of time. For some reason I can never get the get-winevent command to work once I add -credential. Any input is welcomed!
$creds = Get-Credential -Message "Please enter creds"
$Startdate = Read-Host -Prompt "Input your start date in the format of mm/dd/yyyy hh:mm:ss am"
Try{
[DateTime]::Parse($Startdate, [System.Globalization.CultureInfo]::GetCultureInfo("en-US"))
}
Catch{
Write-Host "This time format is incorrect."
}
$Enddate = Read-Host -Prompt "Input your end date in the format of mm/dd/yyyy hh:mm:ss am"
Try{
[DateTime]::Parse($Enddate, [System.Globalization.CultureInfo]::GetCultureInfo("en-US"))
}
Catch{
Write-Host "This time format is incorrect."
}
$Logs = @()
do{
$input = (Read-Host "Please enter in the name of a log")
if($input -ne'') {$Logs += $input}
}
until($input -eq '')
$table = foreach ($Log in $Logs)
{
Get-WinEvent -FilterHashtable @{LogName=$Log;StartTime=$Startdate;EndTime=$Enddate} -Credential $creds
}
$table | sort TimeCreated | Format-Table TimeCreated, Logname, Source, Message -wrap
The error I'm currently receiving.
Get-WinEvent : Attempted to perform an unauthorized operation. At line:40 char:5 + Get-WinEvent -FilterHashtable @{LogName=$Log;StartTime=$Startdate ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-WinEvent], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetWinEventCommand
I think the error comes from not feeding the -FilterHashtable
with the correct data types for $Startdate
and $Enddate
. You check if the users input is in a valid DateTime format, but the variables themselves remain Strings. The -FilterHashtable
requires these parameters to be DateTime
objects as shown in the below table:
Key name Value data type
--------------- ---------------
LogName <String[]>
ProviderName <String[]>
Path <String[]>
Keywords <Long[]>
ID <Int32[]>
Level <Int32[]>
StartTime <DateTime>
EndTime <DateTime>
UserID <SID>
Data <String[]>
Try this:
$creds = Get-Credential -Message "Please enter creds"
# Create variable for parsed start date
[datetime]$Startdate = Get-Date
do {
$input = Read-Host -Prompt "Enter your start date. Use format 'mm/dd/yyyy hh:mm:ss am'"
# Check the user input
$success = ([DateTime]::TryParse($input,
[System.Globalization.CultureInfo]::GetCultureInfo("en-US"),
[System.Globalization.DateTimeStyles]::None,
[ref]$Startdate))
} while (!$success)
# Create variable for parsed end date
[datetime]$Enddate = Get-Date
do {
$input = Read-Host -Prompt "Enter your end date. Use format 'mm/dd/yyyy hh:mm:ss am'"
# Check the user input
$success = ([DateTime]::TryParse($input,
[System.Globalization.CultureInfo]::GetCultureInfo("en-US"),
[System.Globalization.DateTimeStyles]::None,
[ref]$Enddate))
} while (!$success)
$Logs = @()
while ($true) {
$logName = Read-Host -Prompt "Please enter in the name of a log"
if ([string]::IsNullOrEmpty($logName)) { break }
$Logs += $logName
}
$table = foreach ($Log in $Logs) {
# note that we use [DateTime] objects $Startdate and $Enddate
Get-WinEvent -FilterHashtable @{LogName=$Log;StartTime=$Startdate;EndTime=$Enddate} -Credential $creds
}
$table | Sort-Object TimeCreated | Format-Table TimeCreated, Logname, Source, Message -Wrap
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.