Created
October 11, 2015 21:19
-
-
Save scuq/1c9c74a952da3aee06c8 to your computer and use it in GitHub Desktop.
powershell remote read event log (Microsoft-Windows-WLAN-AutoConfig) for roaming event of client
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Param ([string]$hostname=(Read-Host "Enter Hostname")) | |
[int]$lasthours=(Read-Host "How many hours of eventlog? default 8") | |
$addhours = 8; | |
if ($lasthours) { | |
$addhours = $lasthours | |
} | |
if ($hostname) { | |
$filter = @{ LogName = "Microsoft-Windows-WLAN-AutoConfig/Operational" | |
StartTime = [DateTime]::Now.AddHours($addhours*-1) | |
EndTime = [DateTime]::Now | |
} | |
Write-Host ([DateTime]::Now.AddHours($addhours*-1)) | |
Write-Host ([DateTime]::Now) | |
$Events = Get-Winevent -FilterHashtable $filter -ComputerName $hostname | |
# Parse out the event message data | |
ForEach ($Event in $Events) { | |
# Convert the event to XML | |
$eventXML = [xml]$Event.ToXml() | |
# Iterate through each one of the XML message properties | |
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) { | |
# Append these as object properties | |
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text' | |
} | |
} | |
$Events | Select-Object id, MachineName, ProcessId,TimeCreated, Adapter, LocalMac, SSID, Cipher, Auth, PeerMac | Out-GridView | |
Read-Host "press enter to exit" | |
} else { | |
[System.Windows.Forms.MessageBox]::Show("Enter a hostname","No hostname entered",0) | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment