Last year I posted <\/a>an update to an old Mr. Roboto<\/a> script that was an update to an even older VBScript. Still with me? My last revision leveraged the new Get-WinEvent cmdlet to create an HTML report of recent error activity on one or more computers. The problem was that I didn't account for older computers that don't support Get-WinEvent. I finally have a version that does.<\/p>\n This latest, and hopefully last, version will now check the operating system of the computer you want to query.<\/p>\n [cc lang=\"PowerShell\"] I use a simple regular expression match to test the OS version.<\/p>\n [cc lang=\"Powershell\"] [cc lang=\"PowerShell\"] if ($credential) { $status=\"Getting event log data from $computer\" $results+=Invoke-Expression $cmd | I wish I could use Get-Event but it doesn't have a parameter that supports alternate credentials. I could have used remoting, but then I would also have had to assume that PowerShell 2 was installed on legacy systems with remoting enabled and I didn't want to force that assumption on people.<\/p>\n The rest of the function works pretty much as before. All the matching event logs are converted to an HTML file and I parse the HTML to adjust for style tags.<\/p>\n [cc lang=\"PowerShell\"]
\n $os=Get-WmiObject -Query \"Select Caption from Win32_OperatingSystem\" -EnableAllPrivileges -ComputerName $computer -ErrorAction \"Stop\"
\n[\/cc]<\/p>\n
\nIf ($os.caption -match \"2000|XP|2003\") {
\n #if computer is running an old OS then use Get-WMIobject
\n #define some scriptblocks
\n[\/cc]
\nIf the Caption property indicates an OS that is Vista or later, then the rest of the function is pretty much unchanged. Otherwise I use the code I had from my original version that uses Get-WMIObject. The benefit is that now with version 2 we have the -EnableAllPrivileges parameter with Get-WMIObject.<\/p>\n
\n$query=\"Select ComputerName,Message,TimeGenerated,Type,SourceName,EventCode,Logfile from win32_NTLogEvent WHERE (Type='warning' OR Type='error' OR Type='Audit Failure') AND TimeWritten>'$dmtf'\"
\n Write-Verbose $query
\n $cmd='Get-WmiObject -ComputerName $computer -query $query -enableAllPrivileges'<\/p>\n
\n $cmd=$cmd + \" -credential `$credential\"
\n }
\n Write-Verbose $cmd<\/p>\n
\n Write-Progress -Activity $activity -Status $status -CurrentOperation \"Querying logs\"<\/p>\n
\n select @{name=\"Computername\";Expression={($_.ComputerName).ToUpper()}},
\n Type,@{name=\"TimeCreated\";Expression={$_.ConvertToDateTime($_.TimeGenerated)}},
\n @{Name=\"ProviderName\";Expression={$_.SourceName}},
\n @{Name=\"ID\";Expression={$_.EventCode}},Message,
\n @{Name=\"LogName\";Expression={$_.Logfile}}
\n[\/cc]<\/p>\n
\n foreach ($line in $html) {
\n $i++
\n Write-Progress -Activity $activity -Status $status -CurrentOperation \"Colorizing\" -PercentComplete $($i\/($html.count)*100)
\n Switch -regex ($line) {
\n \"<\/p>\n
\" {
\n Write-Verbose \"Colorizing header\"
\n $colorized+=$line.Replace(\"<\/p>\n
\" {
\n Write-Verbose \"Colorizing Error\"
\n $colorized+=$line.Replace(\"<\/p>\n
\" {
\n Write-Verbose \"Colorizing Critical\"
\n $colorized+=$line.Replace(\"<\/p>\n
\"<\/p>\n
\" {
\n Write-Verbose \"Colorizing Audit Failure\"
\n $colorized+=$line.Replace(\"<\/p>\n
\" {
\n Write-Verbose \"Adding footer $($footer)\"
\n $colorized+=$line.Replace(\"<\/table>\n
\",$footer)
\n } <\/p>\n
Default {
\n $colorized+=$line
\n }
\n } #end Switch
\n }
\n[\/cc]<\/p>\n