get-winEvent application get-winEvent system get-winEvent setup # Note: get-eventLog setup is not possible get-winEvent security # requires admin privileges get-winEvent -providerName Microsoft-Windows-Kernel-Power
$time_from = (get-date).AddHours(-10).ToString( "yyyy-MM-ddTHH:mm:ss.fffZ" ) [xml] $qry = @" <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[System[TimeCreated[@SystemTime >= '$time_from' ]]] </Select> </Query> </QueryList> "@ get-winEvent -filterXml $qry
get-winEvent will eventually(?) replace get-eventLog get-eventLog only queries the «traditional» event logs (system, application and security), it cannot query ETL type of logs. get-eventLog is easier to use than get-winEvent. get-winEvent setup is possible, get-eventLog setup throws an error. get-eventLog returns instances of System.Diagnostics.EventLogEntry objects, get-winEvent instances of System.Diagnostics.Eventing.Reader.EventLogRecord. eventvwr.exe and eventvwr.msc get-winEvent is one of the cmdLets with the -computerName parameter.