en-US/PoShEvents-help.xml
|
<?xml version="1.0" encoding="utf-8"?>
<helpItems schema="maml" xmlns="http://msh"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>ConvertFrom-EventLogRecord</command:name> <command:verb>ConvertFrom</command:verb> <command:noun>EventLogRecord</command:noun> <maml:description> <maml:para>This function converts EventLogRecords into human readable output.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function converts EventLogRecords into human readable output.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>ConvertFrom-EventLogRecord</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"> <maml:name>Events</maml:name> <maml:Description> <maml:para>One or more EventLogRecord objects.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">EventLogRecord[]</command:parameterValue> <dev:type> <maml:name>EventLogRecord[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>EventRecordType</maml:name> <maml:Description> <maml:para>Specifies the event record type which, in turn, determines the custom type and therefore the default properties of the output.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">PrintDocument</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">SystemRestartEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">LogonFailureEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">OSVersionFromEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">RemoteLogonEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">GPOProcessingEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">KMSClientEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">KMSHostEvent</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">KMSHostLicenseCheckEvent</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>GroupPolicy</maml:name> <maml:Description> <maml:para>Provide the function all group policy objects in order to have the friendly name presented in the event output. Usually, this can be set to 'Get-GPO -All'.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object[]</command:parameterValue> <dev:type> <maml:name>Object[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>ShowProgress</maml:name> <maml:Description> <maml:para>Using this parameter, the function will show the machine name and the current record number being processed.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>EventRecordType</maml:name> <maml:Description> <maml:para>Specifies the event record type which, in turn, determines the custom type and therefore the default properties of the output.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"> <maml:name>Events</maml:name> <maml:Description> <maml:para>One or more EventLogRecord objects.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">EventLogRecord[]</command:parameterValue> <dev:type> <maml:name>EventLogRecord[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>GroupPolicy</maml:name> <maml:Description> <maml:para>Provide the function all group policy objects in order to have the friendly name presented in the event output. Usually, this can be set to 'Get-GPO -All'.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object[]</command:parameterValue> <dev:type> <maml:name>Object[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>ShowProgress</maml:name> <maml:Description> <maml:para>Using this parameter, the function will show the machine name and the current record number being processed.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.Diagnostics.Eventing.Reader.EventLogRecord[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-WinEvent -LogName System -MaxEvents 5 | ConvertFrom-EventLogRecord</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------------------------- Example 2 --------------------------</maml:title> <dev:code>PS C:\> Get-WinEvent -FilterHashTable @{ProviderName = "Service Control Manager"} -MaxEvents 5 | ConvertFrom-EventLogRecord -EventRecordType ServiceEvent</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/ConvertFrom-EventLogRecord/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-GPOProcessingEvent</command:name> <command:verb>Get</command:verb> <command:noun>GPOProcessingEvent</command:noun> <maml:description> <maml:para>Queries the specific computer or group of computers for group policy processing events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>Queries the specific computer or group of computers for group policy processing events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-GPOProcessingEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>GroupPolicy</maml:name> <maml:Description> <maml:para>Provide the function all group policy objects in order to have the friendly name presented in the event output.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object[]</command:parameterValue> <dev:type> <maml:name>Object[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-GPOProcessingEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>GroupPolicy</maml:name> <maml:Description> <maml:para>Provide the function all group policy objects in order to have the friendly name presented in the event output.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object[]</command:parameterValue> <dev:type> <maml:name>Object[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>GroupPolicy</maml:name> <maml:Description> <maml:para>Provide the function all group policy objects in order to have the friendly name presented in the event output.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object[]</command:parameterValue> <dev:type> <maml:name>Object[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>--------------------------- Example ---------------------------</maml:title> <dev:code>PS C:\> Get-GPOProcessingEvent -MaxEvents 10</dev:code> <dev:remarks> <maml:para>This command will show the last 10 group policy processing events on the local system.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>--------------------------- Example ---------------------------</maml:title> <dev:code>PS C:\> Get-GPOProcessingEvent -Since (New-TimeSpan -Days 3)</dev:code> <dev:remarks> <maml:para>This command will show the group policy processing events that occurred on the local system in the last three days.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-GPOProcessingEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-KMSClientEvent</command:name> <command:verb>Get</command:verb> <command:noun>KMSClientEvent</command:noun> <maml:description> <maml:para>This function returns details from KMS client events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function returns details from KMS client events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-KMSClientEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-KMSClientEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-KMSClientEvent ComputerName : WKSTN47.contoso.com TimeCreated : 5/7/2018 3:20:36 PM Id : 12308 Level : Information KMSHost : KMSHostPort : ClientMachineID : ClientTimestamp : ActivationStatus : Active Directory Activation has succeeded. ADActivationObjectName : Windows Server 2016 RTM ServerDatacenter;ServerStandard Volume:CSVLK ADActivationObject : CN=br549-999-607319-0,CN=Activation Objects,CN=Microsoft SPP,CN=Services,CN=Configuration,DC=contoso,DC=com CurrentActivationCount : NextActivationAttempt : LicenseStateExpiration : LicenseStateExpirationMin : ProductSkuId : 73001100-0000-1111-2222-f1d7bf300300 ProductSkuName : Windows 10 Enterprise MinActivateCount : KmsErrorCode : KmsErrorMessage :</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-KMSClientEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-KMSHostEvent</command:name> <command:verb>Get</command:verb> <command:noun>KMSHostEvent</command:noun> <maml:description> <maml:para>This function queries a KMS host server for registration events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function queries a KMS host server for registration events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-KMSHostEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-KMSHostEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-KMSHostEvent -ComputerName SVR01.contoso.com -MaxEvents 10 -Oldest | Format-Table -Property ClientFqdn,ClientTimestamp,IsClientVM,LicenseState,ProductSkuName,MinActivateCount ClientFqdn ClientTimestamp IsClientVM LicenseState ProductSkuName MinActivateCount ---------- --------------- ---------- ------------ -------------- ---------------- WKSTN27.contoso.com 4/10/2018 10:21:00 PM False Grace Period Office Standard 2016 5 WKSTN06.contoso.com 4/10/2018 10:24:00 PM False Grace Period Office Standard 2016 5 MYLAPTOP 4/10/2018 9:26:00 PM False Notifications Mode Windows 10 Enterprise 25 WKSTN63.contoso.com 4/10/2018 10:28:00 PM False Grace Period Office Standard 2013 5 vmwkstn04.contoso.com 4/10/2018 10:31:00 PM True Grace Period Windows 7 Professional 25 WKSTN68.contoso.com 4/10/2018 10:33:00 PM True Grace Period Windows 7 Professional 25 vmwkstn14.contoso.com 4/10/2018 10:33:00 PM True Grace Period Windows 7 Professional 25 WKSTN63 4/10/2018 9:34:00 PM False Grace Period Office Standard 2016 5 WKSTN63 4/10/2018 9:34:00 PM False Notifications Mode Windows 10 Enterprise 25 vmwkstn45.contoso.com 4/10/2018 10:34:00 PM True Grace Period Windows 7 Professional 25</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-KMSHostEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-KMSHostLicenseCheckEvent</command:name> <command:verb>Get</command:verb> <command:noun>KMSHostLicenseCheckEvent</command:noun> <maml:description> <maml:para>This function will search the provider Microsoft-Windows-Security-SPP for KMS Host license checks with Microsoft.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function will search the provider Microsoft-Windows-Security-SPP for KMS Host license checks with Microsoft.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-KMSHostLicenseCheckEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-KMSHostLicenseCheckEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-KMSHostLicenseCheckEvent -ComputerName KMSSVR -Credential (Get-Credential) -MaxEvents 5</dev:code> <dev:remarks> <maml:para>This will return the following propeties: ComputerName TimeCreated Id (always 1003) Level ActivationId ApplicationName LicensingStatusMessage The full license status message which will need to be manually decoded.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-KMSHostLicenseCheckEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-LogonFailureEvent</command:name> <command:verb>Get</command:verb> <command:noun>LogonFailureEvent</command:noun> <maml:description> <maml:para>This function searches for logon failure events, those events with Ids of 4625 and 4771.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function searches for logon failure events, those events with Ids of 4625 and 4771.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-LogonFailureEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-LogonFailureEvent -ComputerName dc07 -MaxEvents 10 -Credential (Get-Credential) | Format-Table -Property ComputerName,TimeCreated,TargetUserName,IPAddress,IpPort,LogonMethod,Reason ComputerName TimeCreated TargetUserName IpAddress LogonMethod Reason ------------ ----------- -------------- --------- ----------- ------ DC1.contoso.com 5/11/2018 8:39:29 PM rtorn 192.168.1.22 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:39:27 PM tljones 192.168.1.18 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:39:27 PM ftpug 192.168.1.66 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:39:24 PM ftpug 192.168.1.66 Undetermined logon method 0x18 DC1.contoso.com 5/11/2018 8:38:51 PM WKSTN99$ 192.168.1.9 Network Account currently disabled. DC1.contoso.com 5/11/2018 8:37:41 PM jknoxville 192.168.1.67 Undetermined logon method 0x18</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-LogonFailureEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-OSVersionFromEvent</command:name> <command:verb>Get</command:verb> <command:noun>OSVersionFromEvent</command:noun> <maml:description> <maml:para>This function returns the OperatingSystem version.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function returns the OperatingSystem version based on the data in last EventID 6009 in the system log.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-OSVersionFromEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>All</maml:name> <maml:Description> <maml:para>Return all available events.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>All</maml:name> <maml:Description> <maml:para>Return all available events.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-OSVersionFromEvent ComputerName OperatingSystemVersion ------------ ---------------------- WKSTN07.contoso.com 10.00.17134</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-OSVersionFromEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-PrintDocumentEvent</command:name> <command:verb>Get</command:verb> <command:noun>PrintDocumentEvent</command:noun> <maml:description> <maml:para>This function will show you details for the successful print jobs that the system has processed.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function will show you details for the successful print jobs that the system has processed.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-PrintDocumentEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>ClientMachineName</maml:name> <maml:Description> <maml:para>Filter by the client machine host name.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PrinterName</maml:name> <maml:Description> <maml:para>Filter events for the specified printer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PrinterPort</maml:name> <maml:Description> <maml:para>Filter events for the specified printer port name, e.g. IP_172.16.5.27</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>UserName</maml:name> <maml:Description> <maml:para>Filter the results by the user which printed documents. Provide the SamAccountName only.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>DocumentName</maml:name> <maml:Description> <maml:para>Filter the results by the name of the printed document.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PagesPrinted</maml:name> <maml:Description> <maml:para>Filter the results by the number of pages printed.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-PrintDocumentEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>ClientMachineName</maml:name> <maml:Description> <maml:para>Filter by the client machine host name.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PrinterName</maml:name> <maml:Description> <maml:para>Filter events for the specified printer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PrinterPort</maml:name> <maml:Description> <maml:para>Filter events for the specified printer port name, e.g. IP_172.16.5.27</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>UserName</maml:name> <maml:Description> <maml:para>Filter the results by the user which printed documents. Provide the SamAccountName only.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>DocumentName</maml:name> <maml:Description> <maml:para>Filter the results by the name of the printed document.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PagesPrinted</maml:name> <maml:Description> <maml:para>Filter the results by the number of pages printed.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>ClientMachineName</maml:name> <maml:Description> <maml:para>Filter by the client machine host name.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PrinterName</maml:name> <maml:Description> <maml:para>Filter events for the specified printer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PrinterPort</maml:name> <maml:Description> <maml:para>Filter events for the specified printer port name, e.g. IP_172.16.5.27</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>UserName</maml:name> <maml:Description> <maml:para>Filter the results by the user which printed documents. Provide the SamAccountName only.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>DocumentName</maml:name> <maml:Description> <maml:para>Filter the results by the name of the printed document.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>PagesPrinted</maml:name> <maml:Description> <maml:para>Filter the results by the number of pages printed.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> C:\PowerShell\Get-PrintDocumentEvent -ComputerName printsvc -MaxEvents 1 -Oldest ComputerName : PRINTSVR TimeCreated : 10/5/2017 8:12:05 AM PrintJobId : 234 DocumentName : Print Document UserName : CONTOSO\KSmith2 ClientMachineName : WKSTN07 PrinterName : HPColorPrinter PrinterPort : IP_172.16.5.37 DocumentSizeBytes : 1557928 DocumentPageCount : 2</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-PrintDocumentEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-RemoteLogonEvent</command:name> <command:verb>Get</command:verb> <command:noun>RemoteLogonEvent</command:noun> <maml:description> <maml:para>This function queries the security log for EventIds 4624,4625,4634,4778,4779.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function queries the security log for EventIds 4624,4625,4634,4778,4779.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-RemoteLogonEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-RemoteLogonEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-RemoteLogonEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-RemoteLogonEvent -ComputerName WKSTN47 -MaxEvents 5 ComputerName : WKSTN47.contoso.com TimeCreated : 5/11/2018 1:16:51 PM Id : 4625 Level : Information EventType : Logon Failure UserName : WKSTN47\GUEST IpAddress : LogonID : Reason : Account currently disabled. LogonMethod : Network ComputerName : WKSTN47.contoso.com TimeCreated : 5/11/2018 11:15:51 AM Id : 4625 Level : Information EventType : Logon Failure UserName : CONTOSO\CARROLLD IpAddress : 127.0.0.1 LogonID : Reason : Unknown user name or bad password. LogonMethod : Interactive (local system)</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-RemoteLogonEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-ServiceEvent</command:name> <command:verb>Get</command:verb> <command:noun>ServiceEvent</command:noun> <maml:description> <maml:para>This function will query the specified system for all service control manager events for service operations, stop, and start events. You can then filter on a particular service name or service displayname.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function will query the specified system for all service control manager events for service operations, stop, and start events. You can then filter on a particular service name or service displayname.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-ServiceEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventType</maml:name> <maml:Description> <maml:para>Specifies the type of service event.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">ServiceOperations</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceStart</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceStop</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceControlManagerOperations</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceInstall</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-ServiceEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventType</maml:name> <maml:Description> <maml:para>Specifies the type of service event.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">ServiceOperations</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceStart</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceStop</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceControlManagerOperations</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">ServiceInstall</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventType</maml:name> <maml:Description> <maml:para>Specifies the type of service event.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> (Get-ServiceEvent).Where({$_.ServiceDisplayName -match "print"}) | Select-Object -Property TimeCreated,EventType,ServiceName,ServiceDisplayName,Message TimeCreated : 9/12/2017 9:41:27 PM EventType : ServiceOperations ServiceName : ServiceDisplayName : Printer Extensions and Notifications Message : The Printer Extensions and Notifications service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. TimeCreated : 10/3/2017 10:42:18 PM EventType : ServiceOperations ServiceName : Spooler ServiceDisplayName : Print Spooler Message : The start type of the Print Spooler service was changed from auto start to demand start. TimeCreated : 10/3/2017 10:42:20 PM EventType : ServiceOperations ServiceName : Spooler ServiceDisplayName : Print Spooler Message : The start type of the Print Spooler service was changed from demand start to auto start.</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-ServiceEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-SystemRestartEvent</command:name> <command:verb>Get</command:verb> <command:noun>SystemRestartEvent</command:noun> <maml:description> <maml:para>This function returns the details for system startup and shutdown events.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>This function returns the details for system startup and shutdown events including identifying the user and application that initiated the shutdown (if available).</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-SystemRestartEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="0" aliases="IPAddress, __Server, CN"> <maml:name>ComputerName</maml:name> <maml:Description> <maml:para>Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Credential</maml:name> <maml:Description> <maml:para>Specifies a user account that has permission to perform this action. The default value is the current user.</maml:para> <maml:para>Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type> <maml:name>PSCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>MaxEvents</maml:name> <maml:Description> <maml:para>Specifies the maximum number of events this function returns. The default is to return all the events in the logs.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Oldest</maml:name> <maml:Description> <maml:para>Returns the events in oldest-first order. By default, events are returned in newest-first order.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Raw</maml:name> <maml:Description> <maml:para>Use this switch to provide the raw event log record for the function.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> Get-SystemRestartEvent -MaxEvents 10 | Format-Table ComputerName TimeCreated Id ProviderName Level Status UserName Reason Details ------------ ----------- -- ------------ ----- ------ -------- ------ ------- WKSTN07.contoso.com 5/9/2018 1:27:51 PM 6005 EventLog Information Startup WKSTN07.contoso.com 5/9/2018 1:27:51 PM 6009 EventLog Information System Info WKSTN07.contoso.com 5/9/2018 1:27:51 PM 6008 EventLog Error Unexpected Shutdown WKSTN07.contoso.com 5/7/2018 3:23:12 PM 6005 EventLog Information Startup WKSTN07.contoso.com 5/7/2018 3:23:12 PM 6009 EventLog Information System Info WKSTN07.contoso.com 5/7/2018 3:22:29 PM 6006 EventLog Information Shutdown WKSTN07.contoso.com 5/7/2018 3:22:12 PM 1074 User32 Information Shutdown Initiated CONTOSO\carrolld Other (Unplanned) RuntimeBroker.exe WKSTN07.contoso.com 5/3/2018 11:09:31 PM 6005 EventLog Information Startup WKSTN07.contoso.com 5/3/2018 11:09:31 PM 6009 EventLog Information System Info WKSTN07.contoso.com 5/3/2018 11:08:41 PM 6006 EventLog Information Shutdown</dev:code> <dev:remarks> <maml:para></maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Get-SystemRestartEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>New-EventDataFilter</command:name> <command:verb>New</command:verb> <command:noun>EventDataFilter</command:noun> <maml:description> <maml:para>Creates the text string that can be used with the `New-EventFilterXml` function to filter by named EventData data.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>Creates the text string that can be used with the `New-EventFilterXml` function to filter by named EventData data.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>New-EventDataFilter</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"> <maml:name>Hashtable</maml:name> <maml:Description> <maml:para>The hashtable should contain UserData and/or EventData each with their own hashtable.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Hashtable</command:parameterValue> <dev:type> <maml:name>Hashtable</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"> <maml:name>Hashtable</maml:name> <maml:Description> <maml:para>The hashtable should contain UserData and/or EventData each with their own hashtable.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Hashtable</command:parameterValue> <dev:type> <maml:name>Hashtable</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>None</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> $EventData = @{ UserData = @{ DocumentPrinted = @{Param2 = "MyDocumentName" }}} PS C:\> New-EventDataFilter -Hashtable $EventData *[UserData[DocumentPrinted[(Param2="MyDocumentName.docx")]]]</dev:code> <dev:remarks> <maml:para>Create a EventData filter for the printed document named MyDocumentName.docx.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/New-EventDataFilter/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>New-EventFilterXml</command:name> <command:verb>New</command:verb> <command:noun>EventFilterXml</command:noun> <maml:description> <maml:para>Creates XML that can be used to query event logs using the `Get-WinEvent` cmdlet.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>Creates XML that can be used to query event logs using the `Get-WinEvent` cmdlet.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>New-EventFilterXml</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Audit</maml:name> <maml:Description> <maml:para>Specifies the audit level for the Security to add to the XML filter.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">Success</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Failure</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventDataFilter</maml:name> <maml:Description> <maml:para>Specifies a string data filter generated by the `New-EventDataFilter` function.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="Id"> <maml:name>EventId</maml:name> <maml:Description> <maml:para>Specifies one or more event IDs to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="Level"> <maml:name>LevelDisplayName</maml:name> <maml:Description> <maml:para>Specifies one or more event log levels to add to the XML filter.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">LogAlways</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Critical</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Error</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Warning</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Informational</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Verbose</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Issues</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">LogLevelName[]</command:parameterValue> <dev:type> <maml:name>LogLevelName[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>LogName</maml:name> <maml:Description> <maml:para>Specifies the event log name to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Provider</maml:name> <maml:Description> <maml:para>Specifies the event provider, sometimes called event source, to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>XPath</maml:name> <maml:Description> <maml:para>Return only an XPath filter.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>New-EventFilterXml</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Audit</maml:name> <maml:Description> <maml:para>Specifies the audit level for the Security to add to the XML filter.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">Success</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Failure</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventDataFilter</maml:name> <maml:Description> <maml:para>Specifies a string data filter generated by the `New-EventDataFilter` function.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="Id"> <maml:name>EventId</maml:name> <maml:Description> <maml:para>Specifies one or more event IDs to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="Level"> <maml:name>LevelDisplayName</maml:name> <maml:Description> <maml:para>Specifies one or more event log levels to add to the XML filter.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">LogAlways</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Critical</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Error</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Warning</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Informational</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Verbose</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Issues</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">LogLevelName[]</command:parameterValue> <dev:type> <maml:name>LogLevelName[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>LogName</maml:name> <maml:Description> <maml:para>Specifies the event log name to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Provider</maml:name> <maml:Description> <maml:para>Specifies the event provider, sometimes called event source, to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="TimeSpan"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>XPath</maml:name> <maml:Description> <maml:para>Return only an XPath filter.</maml:para> </maml:Description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Audit</maml:name> <maml:Description> <maml:para>Specifies the audit level for the Security to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EndTime</maml:name> <maml:Description> <maml:para>Specifies the end of the time period to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>EventDataFilter</maml:name> <maml:Description> <maml:para>Specifies a string data filter generated by the `New-EventDataFilter` function.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="Id"> <maml:name>EventId</maml:name> <maml:Description> <maml:para>Specifies one or more event IDs to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="Level"> <maml:name>LevelDisplayName</maml:name> <maml:Description> <maml:para>Specifies one or more event log levels to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">LogLevelName[]</command:parameterValue> <dev:type> <maml:name>LogLevelName[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>LogName</maml:name> <maml:Description> <maml:para>Specifies the event log name to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Provider</maml:name> <maml:Description> <maml:para>Specifies the event provider, sometimes called event source, to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="TimeSpan"> <maml:name>Since</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period for the event log query based on the given amount of time.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">TimeSpan</command:parameterValue> <dev:type> <maml:name>TimeSpan</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>StartTime</maml:name> <maml:Description> <maml:para>Specifies the beginning of the time period to add to the XML filter.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>XPath</maml:name> <maml:Description> <maml:para>Return only an XPath filter.</maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>None</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> New-EventFilterXml -LogName Application -Provider MyEventSource -Since (New-TimeSpan -Days 3) -LevelDisplayName Critical,Error <QueryList> <Query Id="0" Path="Application"> <Select Path="Application">*[System[Provider[@Name="MyEventSource"] and (Level=1 or Level=2) and TimeCreated[timediff(@SystemTime) &lt;= 259200000]]]</Select> </Query> </QueryList></dev:code> <dev:remarks> <maml:para>Create an XML filter to query the Application event log with MyEventSource provider for all Critical and Error events since the last 3 days.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/New-EventFilterXml/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>New-EventSource</command:name> <command:verb>New</command:verb> <command:noun>EventSource</command:noun> <maml:description> <maml:para>Create a new event source, also called event provider, for an event log.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>Create a new event source, also called event provider, for an event log.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>New-EventSource</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"> <maml:name>EventLog</maml:name> <maml:Description> <maml:para>The name of the event log.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Source</maml:name> <maml:Description> <maml:para>The name of the new source, or provider.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"> <maml:name>EventLog</maml:name> <maml:Description> <maml:para>The name of the event log.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Source</maml:name> <maml:Description> <maml:para>The name of the new source, or provider.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>None</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> New-EventSource -EventLog "Windows PowerShell" -Source thedavecarroll</dev:code> <dev:remarks> <maml:para>Add a new source, thedavecarroll, to the Windows PowerShell event log.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/New-EventSource/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Write-WinEvent</command:name> <command:verb>Write</command:verb> <command:noun>WinEvent</command:noun> <maml:description> <maml:para>Write an event to the given event log.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>Write an event to the given event log.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Write-WinEvent</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"> <maml:name>LogName</maml:name> <maml:Description> <maml:para>The name of the event log.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Provider</maml:name> <maml:Description> <maml:para>The provider, also called source, for the event.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>EventId</maml:name> <maml:Description> <maml:para>The Id for the event.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EventType</maml:name> <maml:Description> <maml:para>The display level for the event.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">Error</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Warning</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">Information</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">SuccessAudit</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">FailureAudit</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">EventLogEntryType</command:parameterValue> <dev:type> <maml:name>EventLogEntryType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>EventData</maml:name> <maml:Description> <maml:para>An ordered hashtable, also called dictionary.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">OrderedDictionary</command:parameterValue> <dev:type> <maml:name>OrderedDictionary</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="5" aliases="none"> <maml:name>MessageFormat</maml:name> <maml:Description> <maml:para>Specifies the format of the event Message property. The EventData will be converted to this format in its entirety.</maml:para> </maml:Description> <command:parameterValueGroup> <command:parameterValue required="false" command:variableLength="false">JSON</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">CSV</command:parameterValue> <command:parameterValue required="false" command:variableLength="false">XML</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="4" aliases="none"> <maml:name>EventData</maml:name> <maml:Description> <maml:para>An ordered hashtable, also called dictionary.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">OrderedDictionary</command:parameterValue> <dev:type> <maml:name>OrderedDictionary</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"> <maml:name>EventId</maml:name> <maml:Description> <maml:para>The Id for the event.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int64</command:parameterValue> <dev:type> <maml:name>Int64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"> <maml:name>EventType</maml:name> <maml:Description> <maml:para>The display level for the event.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">EventLogEntryType</command:parameterValue> <dev:type> <maml:name>EventLogEntryType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"> <maml:name>LogName</maml:name> <maml:Description> <maml:para>The name of the event log.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="5" aliases="none"> <maml:name>MessageFormat</maml:name> <maml:Description> <maml:para>Specifies the format of the event Message property. The EventData will be converted to this format in its entirety.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"> <maml:name>Provider</maml:name> <maml:Description> <maml:para>The provider, also called source, for the event.</maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>None</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>System.Object</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- Example 1 --------------------------</maml:title> <dev:code>PS C:\> $EventData = [ordered]@{Program = 'MyProgram';ThisEvent = 'This is an event I want to track'; SomethingElse = 'I like the C64'} PS C:\> Write-WinEvent -LogName "Windows PowerShell" -Provider thedavecarroll -EventId 100 -EventType Information -EventData $EventData</dev:code> <dev:remarks> <maml:para>Create a new informational event log entry in the "Windows PowerShell" event log with the provider of thedavecarroll.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version</maml:linkText> <maml:uri>https://poshevents.anovelidea.org/en/latest/Write-WinEvent/</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> </helpItems> |