Skip to content

Instantly share code, notes, and snippets.

@rleap-m
Last active September 11, 2020 20:46
Show Gist options
  • Save rleap-m/f572baaae212c3a5ba5b9b2add7bf1e6 to your computer and use it in GitHub Desktop.
Save rleap-m/f572baaae212c3a5ba5b9b2add7bf1e6 to your computer and use it in GitHub Desktop.
A script which can export Windows classic event logs (Application, System, Security) to an evtx file
# Followed this article: https://www.thomasmaurer.ch/2011/05/powershell-how-to-export-windows-eventlogs-with-powershell/
[CmdletBinding()]
param (
[Parameter(Mandatory=$false)]
[ValidateSet('Application','HardwareEvents','Security','System','Windows PowerShell')]
[string] $LogFileName = 'Application'
)
$exportFileName = Join-Path -Path $ENV:TEMP -ChildPath ($ENV:COMPUTERNAME + '_' + $logFileName + "_" + "$(Get-Date -f yyyyMMdd).evtx")
$logFile = Get-WmiObject -Class Win32_NTEventlogFile | Where-Object {$_.LogFileName -eq $LogFileName}
if ($logFile) {
$null = $logFile.BackupEventLog($exportFileName)
if (Test-Path -Path $exportFileName -PathType Leaf) {
Write-Host "Please attach file [$exportFileName] to case."
}
else {
Write-Warning "Unable to export events to [$exportFileName]."
}
}
else {
Write-Warning "Unable to retrieve a reference to the [$LogFileName] event log."
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment