Public/Start-AdfsServerTrace.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
<#
.SYNOPSIS
Starts background jobs to search events based on AD FS Activity ID accross different computers
 
.DESCRIPTION
The Start-AdfsServerTrace cmdlet queries all computers' event logs for the activity ID supplied in parallel as background jobs.
Use the Receive-AdfsServerTrace cmdlet to retrieve and combine the results
This cmdlets works in AD FS 2.0 and later.
 
.PARAMETER activityId
Activity ID to search for. This typically comes from an AD FS error page.
 
.PARAMETER ComputerName
It is an array of computers, which represents the AD FS servers to try.
 
.EXAMPLE
Start-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -ComputerName @("ADFSSRV1","ADFSSRV2")
Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df on Servers ADFSSRV1 and ADFSSRV2
 
.EXAMPLE
Start-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -ComputerName (Get-Content .\Servers.txt)
Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df from servers in a text file
 
.EXAMPLE
Start-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -IncludeDebug -ComputerName @("ADFSSRV1","ADFSSRV2")
Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df on Server ADFSSRV1 and ADFSSRV2, including debug traces
 
.NOTES
You need to run this function using an account that has permissions to read the event logs in all computers supplied.
This is typically achieved having the account be part of the "Event Log Readers" Local Security Group.
The computers supplied also should have firewall rules configured to allow remote readings.
#>

Function Start-AdfsServerTrace
{
    Write-DeprecationNotice
}