Last active
September 11, 2020 20:46
-
-
Save rleap-m/f572baaae212c3a5ba5b9b2add7bf1e6 to your computer and use it in GitHub Desktop.
A script which can export Windows classic event logs (Application, System, Security) to an evtx file
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Followed this article: https://www.thomasmaurer.ch/2011/05/powershell-how-to-export-windows-eventlogs-with-powershell/ | |
[CmdletBinding()] | |
param ( | |
[Parameter(Mandatory=$false)] | |
[ValidateSet('Application','HardwareEvents','Security','System','Windows PowerShell')] | |
[string] $LogFileName = 'Application' | |
) | |
$exportFileName = Join-Path -Path $ENV:TEMP -ChildPath ($ENV:COMPUTERNAME + '_' + $logFileName + "_" + "$(Get-Date -f yyyyMMdd).evtx") | |
$logFile = Get-WmiObject -Class Win32_NTEventlogFile | Where-Object {$_.LogFileName -eq $LogFileName} | |
if ($logFile) { | |
$null = $logFile.BackupEventLog($exportFileName) | |
if (Test-Path -Path $exportFileName -PathType Leaf) { | |
Write-Host "Please attach file [$exportFileName] to case." | |
} | |
else { | |
Write-Warning "Unable to export events to [$exportFileName]." | |
} | |
} | |
else { | |
Write-Warning "Unable to retrieve a reference to the [$LogFileName] event log." | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment