Issues with Get-WinEvent running in remoting session

Asked Aug 03 '15 at 21:54

Active Aug 03 '15 at 21:54

Viewed 577 times

Looks like below code does not work

$EventLogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4    908","4964"
$MultipleIDLogEntries={Get-WinEvent -FilterHashtable     @{Logname='security';Id=@($using:EventLogonIDs)}}
Get-PSSession | % {icm -Session $_ -Command $MultipleIDLogEntries}

it returns below for each server

No events were found that match the specified selection criteria. + CategoryInfo : ObjectNotFound: (:) [Get-WinEvent], Exception + FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand + PSComputerName : testitservice.cloudapp.net

But if $EventLogonIDs="4624", it just works with no issues.

What is wrong? Thanks!

asked Aug 03 '15 at 21:54

Andrey Vernigora

Why do you have spaces between 4 and 908? – Greg Askew Aug 03 '15 at 22:07
No, this is because of indentation here. I did not get right away how to indent code block correctly – Andrey Vernigora Aug 04 '15 at 08:25
On the other hand it works this way $MultipleIDLogEntries={$using:EventLogonIDs | % {Get-WinEvent -FilterHashtable @{Logname='security';Id=$_}}} Get-PSSession | % {icm -Session $_ -Command $MultipleIDLogEntries} – Andrey Vernigora Aug 04 '15 at 09:09
nope it does not, it getting stuck – Andrey Vernigora Aug 04 '15 at 10:07
@AndreyVernigora I've seen this before, where FilterHashtable.Id only takes up to 23 numerical arguments, any more and it immediately returns with no "NoMatchingEventsFound" error. If you cut down the list to, say, 10 event id's, does it work? – Mathias R. Jessen Aug 04 '15 at 10:07

Issues with Get-WinEvent running in remoting session

0 Answers0