Advertisement
guyrleech

Show possible event ids per event log provider

Jun 14th, 2023
1,057
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ## Show possible event ids per event log provider
  2.  
  3. Get-WinEvent -ListProvider * | Where-Object Events -ne $null | ForEach-Object `
  4. {
  5.     $provider = $_
  6.     ForEach( $event in $provider.events )
  7.     {
  8.         [int]$propertyCount = $null
  9.         [string[]]$propertyNames = @()
  10.  
  11.         if( $event.PSObject.Properties[ 'template' ] -and $event.Template )
  12.         {
  13.             [xml]$template = $event.Template
  14.             if( $template )
  15.             {
  16.                 $propertyCount = $template.template.data.count
  17.                 $propertyNames = @( $template.template.data | Select-Object -ExpandProperty Name )
  18.             }
  19.         }
  20.  
  21.         Select-Object -InputObject $event -Property @{n='Provider';e={$provider.Name}},
  22.             @{n='Log';e={$_.LogLink.LogName}},
  23.             @{n='Id';e={$_.Id}},
  24.             @{n='Properties';e={$propertyCount}} ,
  25.             @{n='PropertyNames';e={ $propertyNames -join ',' }} ,
  26.             @{n='Message';e={$_.description}}
  27.     }
  28. }
  29.  
Tags: eventlog
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement