powershellget-eventlog

Failed to get ComputerName in Powershell Get-Eventlog

In Security section in Event Viewer, there is a column named "Computer".

I am using powershell to retrieve "all event ID 100" as of yesterday and display columns "event ID" and "computer".

Get-EventLog Security -After "2016-08-25 08:08:08" | Where-Object { ($_.instanceid) -eq 100 } | select-object "computer", "instanceID"

However, it only shows blank records for Computer column.

Please help. Thank you.

Solution

  • Try it with MachineName like so 

    ... select-object "MachineName", "instanceID"

    You can find that out when piping your objects to 

    Get-EventLog ... | Get-Member

    where you will find a property MachineName