-
-
Save maddtech/dd9f4a9bdc4e1bfd796c9460c44c81f2 to your computer and use it in GitHub Desktop.
powershell remote read event log (Microsoft-Windows-WLAN-AutoConfig) for roaming event of client
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Param ([string]$hostname=(Read-Host "Enter Hostname")) | |
[int]$lasthours=(Read-Host "How many hours of eventlog? default 8") | |
$addhours = 8; | |
if ($lasthours) { | |
$addhours = $lasthours | |
} | |
if ($hostname) { | |
$filter = @{ LogName = "Microsoft-Windows-WLAN-AutoConfig/Operational" | |
StartTime = [DateTime]::Now.AddHours($addhours*-1) | |
EndTime = [DateTime]::Now | |
} | |
Write-Host ([DateTime]::Now.AddHours($addhours*-1)) | |
Write-Host ([DateTime]::Now) | |
$Events = Get-Winevent -FilterHashtable $filter -ComputerName $hostname | |
# Parse out the event message data | |
ForEach ($Event in $Events) { | |
# Convert the event to XML | |
$eventXML = [xml]$Event.ToXml() | |
# Iterate through each one of the XML message properties | |
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) { | |
# Append these as object properties | |
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text' | |
} | |
} | |
$Events | Select-Object id, MachineName, ProcessId,TimeCreated, Adapter, LocalMac, SSID, Cipher, Auth, PeerMac | Out-GridView | |
Read-Host "press enter to exit" | |
} else { | |
[System.Windows.Forms.MessageBox]::Show("Enter a hostname","No hostname entered",0) | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment