Hi,
We have a basic script which query the event log in the DCs and in the local exchange server.
These are the commands:
1) Exchange
Get-EventLog -ComputerName Exchange_Server -LogName "MSExchange Management" -EntryType Information -InstanceId 1073741825 -After $BeginDate -Before $EndDate
2) DCs
Get-WinEvent -ComputerName DC_Sevrer -FilterHashtable @{LogName="security"; startTime=$BeginDate; id=4720}
When running the script manually - everything work as expected.
When I tried running the script as a scheduale task, with 'nt authority\system' user, the event log part is failing.
I tried setting the scheduale task with my account - if storing a password it is working, otherwise not.
So I opened PowerShell session with 'nt authority\system' and try run the commands manualy - im getting the following error:
get-WinEvent : Could not retrieve information about the Security log. Error: Attempted to perform an unauthorized operation
(Get-EventLog is failing to with a similar error)
The goal is to run this script as scheduale task - 'nt authority\system' is the user that I use for such tasks, but I cant understand what is the issue...
The servers are 2012R2,2016 and 2019 Win Server.
Appriciate your assitance here.
Thanks.