Need script to get Saved Event Logs in Windows from Windows Events

Discussion in 'Scripting' started by jul12, Mar 29, 2016.

  1. jul12

    jul12 MDL Member

    Jan 28, 2011
    127
    10
    10
    Hello!

    Can someone give script (Only for PowerShell!) to get Events from Saved Events which are on local computer saved.

    $log = Get-Eventlog -LogName Security

    foreach ($i in $log){ if (($i.EventID -eq 4624 ) -and ($i.ReplacementStrings[8] -eq 2)){write-host "Logon`t`tDate: "$i.TimeGenerated "`tUser: "$i.ReplacementStrings[5]} if ($i.EventID -eq 4647 ){write-host "Logoff`t`tDate: "$i.TimeGenerated "`tUser: "$i.ReplacementStrings[1]}}

    These scripts give me logs from already active events but not from archived. What is command to get events from archived in local computer?

    Any ideas.

    It is high important because I need it as soon as possible.

    Many Thanks!

    Best Regards!
    :worthy:
     
  2. andruszd

    andruszd MDL Novice

    May 26, 2011
    12
    1
    0
    Looking at old event logs

    have a look at the following link => blogs.technet.microsoft.com/heyscriptingguy/2011/01/25/use-powershell-to-parse-saved-event-logs-for-errors/