Public/Get-AdfsServerTrace.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
<#
.SYNOPSIS
Retrieves all the AD FS events generated given an Activity ID ID accross different computers
 
.DESCRIPTION
The Get-ADFSActivityIdRecords cmdlet queries all computers' event logs for the activity ID supplied in parallel, and them combines and sorts the results.
This cmdlet works in AD FS 2.0 and later.
 
 
.PARAMETER ActivityId
Activity ID to search for. This typically comes from an AD FS error page.
 
.PARAMETER ComputerName
It is an array of computers, which represents the AD FS servers to try. If omitted, the local machine will be used
 
.PARAMETER OutHtmlFilePath
If supplied, the results will be generated in an html table format, saved in the path specified and opened in the internet browser.
 
.EXAMPLE
Get-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -ComputerName @("ADFSSRV1","ADFSSRV2")
Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df on Servers ADFSSRV1 and ADFSSRV2
 
.EXAMPLE
Get-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -ComputerName (Get-Content .\Servers.txt)
Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df from servers in a text file
 
.EXAMPLE
Get-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -IncludeDebug -ComputerName @("ADFSSRV1","ADFSSRV2")
Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df on Server ADFSSRV1 and ADFSSRV2, including debug traces
 
.EXAMPLE
Get-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -IncludeDebug -ComputerName @("ADFSSRV1","ADFSSRV2") -OutHtmlFilePath ".\ActivityIdReport.htm"
Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df on Server ADFSSRV1 and ADFSSRV2, including debug traces and save the result in an HTML file.
 
.NOTES
You need to run this function using an account that has permissions to read the event logs in all computers supplied.
This is typically achieved having the account be part of the "Event Log Readers" Local Security Group.
The computers supplied also should have firewall rules configured to allow remote readings.
#>

Function Get-AdfsServerTrace
{
    Write-DeprecationNotice
}