en-US/PoShEvents-help.xml
|
<?xml version="1.0" encoding="utf-8"?>
<helpItems schema="maml" xmlns="http://msh"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-AccountManagementEvent</command:name> <command:verb>Get</command:verb> <command:noun>AccountManagementEvent</command:noun> <maml:description> <maml:para>This function searches the security log for a specific event Id or for activity fora particular audit group. Each audit group corresponds a selection of event Ids.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function searches the security log for a specific event Id or for activity for a particular audit group. Each audit group corresponds a selection of event Ids.</maml:para> <maml:para>Here is a comprehensive list of event Ids for the audit groups:</maml:para> <maml:para>UserAccount = 4720,4722,4723,4724,4725,4726,4738,4740,4765,4766,4767,4780,4781,4794,5376,5377</maml:para> <maml:para>SecurityEnabledGroup = 4727,4728,4729,4730,4731,4732,4733,4734,4735,4737,4754,4755,4756,4757,4758,4764</maml:para> <maml:para>DistributionGroup = 4744,4745,4746,4747,4748,4749,4750,4751,4752,4753,4759,4760,4761,4762</maml:para> <maml:para>ComputerAccount = 4741,4742,4743</maml:para> <maml:para>ApplicationGroup = 4783,4784,4785,4786,4787,4788,4789,4790</maml:para> <maml:para>DSObject = 5136,5137,5139,5141</maml:para> <maml:para>AccountLockout = 4740,4625</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-AccountManagementEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventID</maml:name> <maml:Description> <maml:para>Specify the Event ID with which to query the security log</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32[]</command:parameterValue> <dev:type> <maml:name>Int32[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-AccountManagementEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Type</maml:name> <maml:Description> <maml:para>{{Fill Type Description}}</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">UserAccount</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">SecurityEnabledGroup</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">DistributionGroup</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ComputerAccount</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ApplicationGroup</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">DSObject</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">AccountLockout</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventID</maml:name> <maml:Description> <maml:para>Specify the Event ID with which to query the security log</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32[]</command:parameterValue> <dev:type> <maml:name>Int32[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Type</maml:name> <maml:Description> <maml:para>{{Fill Type Description}}</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-AccountManagementEvent -ComputerName DC1 -StartTime (Get-Date).AddHours(-1) -Type ComputerAccount -MaxEvents 5</dev:code> <dev:remarks> <maml:para>This command will query the server DC1 for all computer account activity within the last hour, limiting the results to the last 5.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------------------------- Example 2 --------------------------</maml:title> <dev:code>PS C:\> Get-AccountManagementEvent -ComputerName SVRXCH01 -Type UserAccount -Credential (Get-Credential) | Where-Object { $_.UserName -match 'carroll'}</dev:code> <dev:remarks> <maml:para>This command will query the server SVRXCH01 for all user account activity, filtering for a match on UserName (SamAccountName).</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-GPOProcessingEvent</command:name> <command:verb>Get</command:verb> <command:noun>GPOProcessingEvent</command:noun> <maml:description> <maml:para>Queries the specific computer or group of computers for group policy processing events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>Queries the specific computer or group of computers for group policy processing events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-GPOProcessingEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-GPOProcessingEvent -MaxEvents 10 | Out-GridView</dev:code> <dev:remarks> <maml:para>This command will show the last 10 group policy processing events on the local system in gridview. You can then sort or enter additional criteria in the gridview.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-KMSClientEvent</command:name> <command:verb>Get</command:verb> <command:noun>KMSClientEvent</command:noun> <maml:description> <maml:para>This function returns details from KMS client events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function returns details from KMS client events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-KMSClientEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>{{Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.}}</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>{{Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.}}</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-KMSClientEvent ComputerName : WKSTN47.contoso.com TimeCreated : 5/7/2018 3:20:36 PM Id : 12308 Level : Information KMSHost : KMSHostPort : ClientMachineID : ClientTimestamp : ActivationStatus : Active Directory Activation has succeeded. ADActivationObjectName : Windows Server 2016 RTM ServerDatacenter;ServerStandard Volume:CSVLK ADActivationObject : CN=br549-999-607319-0,CN=Activation Objects,CN=Microsoft SPP,CN=Services,CN=Configuration,DC=contoso,DC=com CurrentActivationCount : NextActivationAttempt : LicenseStateExpiration : LicenseStateExpirationMin : ProductSkuId : 73001100-0000-1111-2222-f1d7bf300300 ProductSkuName : Windows 10 Enterprise MinActivateCount : KmsErrorCode : KmsErrorMessage :</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-KMSHostEvent</command:name> <command:verb>Get</command:verb> <command:noun>KMSHostEvent</command:noun> <maml:description> <maml:para>This function queries a KMS host server for registration events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function queries a KMS host server for registration events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-KMSHostEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-KMSHostEvent -ComputerName SVR01.contoso.com -MaxEvents 10 -Oldest | Format-Table -Property ClientFqdn,ClientTimestamp,IsClientVM,LicenseState,ProductSkuName,MinActivateCount ClientFqdn ClientTimestamp IsClientVM LicenseState ProductSkuName MinActivateCount ---------- --------------- ---------- ------------ -------------- ---------------- WKSTN27.contoso.com 4/10/2018 10:21:00 PM False Grace Period Office Standard 2016 5 WKSTN06.contoso.com 4/10/2018 10:24:00 PM False Grace Period Office Standard 2016 5 MYLAPTOP 4/10/2018 9:26:00 PM False Notifications Mode Windows 10 Enterprise 25 WKSTN63.contoso.com 4/10/2018 10:28:00 PM False Grace Period Office Standard 2013 5 vmwkstn04.contoso.com 4/10/2018 10:31:00 PM True Grace Period Windows 7 Professional 25 WKSTN68.contoso.com 4/10/2018 10:33:00 PM True Grace Period Windows 7 Professional 25 vmwkstn14.contoso.com 4/10/2018 10:33:00 PM True Grace Period Windows 7 Professional 25 WKSTN63 4/10/2018 9:34:00 PM False Grace Period Office Standard 2016 5 WKSTN63 4/10/2018 9:34:00 PM False Notifications Mode Windows 10 Enterprise 25 vmwkstn45.contoso.com 4/10/2018 10:34:00 PM True Grace Period Windows 7 Professional 25</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-KMSHostLicenseCheckEvent</command:name> <command:verb>Get</command:verb> <command:noun>KMSHostLicenseCheckEvent</command:noun> <maml:description> <maml:para>{{Fill in the Synopsis}}</maml:para> </maml:description> </command:details> <maml:description> <maml:para>{{Fill in the Description}}</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-KMSHostLicenseCheckEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-KMSHostLicenseCheckEvent -ComputerName KMSSVR -Credential (Get-Credential) -MaxEvents 5</dev:code> <dev:remarks> <maml:para>This will return the following propeties: ComputerName TimeCreated Id (always 1003) Level ActivationId ApplicationName LicensingStatusMessage The full license status message which will need to be manually decoded.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-LogonFailureEvent</command:name> <command:verb>Get</command:verb> <command:noun>LogonFailureEvent</command:noun> <maml:description> <maml:para>This function searchs for logon failure events, those events with Ids of 4625 and 4771.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function searchs for logon failure events, those events with Ids of 4625 and 4771.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-LogonFailureEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-LogonFailureEvent -ComputerName dc07 -MaxEvents 10 -Credential (Get-Credential) | Format-Table -Property ComputerName,TimeCreated,TargetUserName,IPAddress,IpPort,LogonMethod,Reason</dev:code> <dev:remarks> <maml:para>ComputerName TimeCreated TargetUserName IpAddress LogonMethod Reason ------------ ----------- -------------- --------- ----------- ------ DC1.contoso.com 5/11/2018 8:39:29 PM rtorn 192.168.1.22 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:39:27 PM tljones 192.168.1.18 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:39:27 PM ftpug 192.168.1.66 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:39:24 PM ftpug 192.168.1.66 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:38:51 PM WKSTN99$ 192.168.1.9 Network Account currently disabled. DC1.contoso.com 5/11/2018 8:37:41 PM jknoxville 192.168.1.67 Undetermined logon method 0x18</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-OSVersionFromEvent</command:name> <command:verb>Get</command:verb> <command:noun>OSVersionFromEvent</command:noun> <maml:description> <maml:para>This function returns the OperatingSystem version.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function returns the OperatingSystem version based on the data in last EventID 6009 in the system log.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-OSVersionFromEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-OSVersionFromEvent ComputerName OperatingSystemVersion ------------ ---------------------- WKSTN07.contoso.com 10.00.17134</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-PrintDocumentEvent</command:name> <command:verb>Get</command:verb> <command:noun>PrintDocumentEvent</command:noun> <maml:description> <maml:para>This function will show you details for the successful print jobs that the system has processed.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function will show you details for the successful print jobs that the system has processed.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-PrintDocumentEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>{{Specifies the end of the time period for the event log query.}}</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>{{Specifies the end of the time period for the event log query.}}</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> C:\PowerShell\Get-PrintDocumentEvent -ComputerName printsvc -MaxEvents 1 -Oldest ComputerName : PRINTSVR TimeCreated : 10/5/2017 8:12:05 AM PrintJobId : 234 DocumentName : Print Document UserName : CONTOSO\KSmith2 ClientMachineName : WKSTN07 PrinterName : HPColorPrinter PrinterPort : IP_172.16.5.37 DocumentSizeBytes : 1557928 DocumentPageCount : 2</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-RemoteLogonEvent</command:name> <command:verb>Get</command:verb> <command:noun>RemoteLogonEvent</command:noun> <maml:description> <maml:para>This function queries the security log for EventIds 4624,4625,4634,4778,4779.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function queries the security log for EventIds 4624,4625,4634,4778,4779.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-RemoteLogonEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-RemoteLogonEvent -ComputerName WKSTN47 -MaxEvents 5 ComputerName : WKSTN47.contoso.com TimeCreated : 5/11/2018 1:16:51 PM Id : 4625 Level : Information EventType : Logon Failure UserName : WKSTN47\GUEST IpAddress : LogonID : Reason : Account currently disabled. LogonMethod : Network ComputerName : WKSTN47.contoso.com TimeCreated : 5/11/2018 11:15:51 AM Id : 4625 Level : Information EventType : Logon Failure UserName : CONTOSO\CARROLLD IpAddress : 127.0.0.1 LogonID : Reason : Unknown user name or bad password. LogonMethod : Interactive (local system)</dev:code> <dev:remarks> <maml:para>{{ Add example description here }}</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-ServiceEvent</command:name> <command:verb>Get</command:verb> <command:noun>ServiceEvent</command:noun> <maml:description> <maml:para>This function will query the specified system for all service control manager events for service operations, stop, and start events. You can then filter on a particular service name or service displayname.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function will query the specified system for all service control manager events for service operations, stop, and start events. You can then filter on a particular service name or service displayname.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-ServiceEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> (Get-ServiceEvent).Where({$_.ServiceDisplayName -match "print"}) | Select-Object -Property TimeCreated,EventType,ServiceName,ServiceDisplayName,Message TimeCreated : 9/12/2017 9:41:27 PM EventType : ServiceOperations ServiceName : ServiceDisplayName : Printer Extensions and Notifications Message : The Printer Extensions and Notifications service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. TimeCreated : 10/3/2017 10:42:18 PM EventType : ServiceOperations ServiceName : Spooler ServiceDisplayName : Print Spooler Message : The start type of the Print Spooler service was changed from auto start to demand start. TimeCreated : 10/3/2017 10:42:20 PM EventType : ServiceOperations ServiceName : Spooler ServiceDisplayName : Print Spooler Message : The start type of the Print Spooler service was changed from demand start to auto start.</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-SystemRestartEvent</command:name> <command:verb>Get</command:verb> <command:noun>SystemRestartEvent</command:noun> <maml:description> <maml:para>This function returns the details for system startup and shutdown events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function returns the details for system startup and shutdown events including identifying the user and application that initiated the shutdown (if available).</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-SystemRestartEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. Enter an integer. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-SystemRestartEvent -MaxEvents 10 | Format-Table ComputerName TimeCreated Id ProviderName Level Status UserName Reason Details ------------ ----------- -- ------------ ----- ------ -------- ------ ------- WKSTN07.contoso.com 5/9/2018 1:27:51 PM 6005 EventLog Information Startup WKSTN07.contoso.com 5/9/2018 1:27:51 PM 6009 EventLog Information System Info WKSTN07.contoso.com 5/9/2018 1:27:51 PM 6008 EventLog Error Unexpected Shutdown WKSTN07.contoso.com 5/7/2018 3:23:12 PM 6005 EventLog Information Startup WKSTN07.contoso.com 5/7/2018 3:23:12 PM 6009 EventLog Information System Info WKSTN07.contoso.com 5/7/2018 3:22:29 PM 6006 EventLog Information Shutdown WKSTN07.contoso.com 5/7/2018 3:22:12 PM 1074 User32 Information Shutdown Initiated CONTOSO\carrolld Other (Unplanned) RuntimeBroker.exe WKSTN07.contoso.com 5/3/2018 11:09:31 PM 6005 EventLog Information Startup WKSTN07.contoso.com 5/3/2018 11:09:31 PM 6009 EventLog Information System Info WKSTN07.contoso.com 5/3/2018 11:08:41 PM 6006 EventLog Information Shutdown</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks /> </command:command> </helpItems> |