Quantcast
Channel: Windows PowerShell forum
Viewing all articles
Browse latest Browse all 21975

Powershell Get-Eventlog - Unauthorized operation

$
0
0

Hi All

I have a script that retrieves event log from various servers each morning.  It has been working fine for the last 3 years.  However, during the last few days, I noticed that script is failing to retrieve the event logs from one particular domain controller.  Upon investigation (running in Elevated shell) I received the following message:

get-eventlog : Attempted to perform an unauthorized operation.
At line:31 char:1
+ get-eventlog application -computername $servername -entrytype Error,Warning -aft ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-EventLog], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetEventLogCommand

This script runs on my Win8.1 workstation.  As a test, I ran the function on a Win7 (my old workstation which ran this script in the past) device, with same resultsStrange thing is, the second DC in the domain appears to produce event logs via the script just fine.  These DC's are identical Win 2008 R2 Domain Controllers, and no WSUS updates applied in the last week to either device.

Now, I've seen a few forums discussing this, but no real fix or advice.  I tried Get-Winevent as suggested in one post, using the -Credential switch, but failed as well.  And yes, I have Admin and Domain Admin and Enterprise Admin rights on this domain (all my credentials fail):

Get-WinEvent : A security package specific error occurred
At line:1 char:1
+ Get-WinEvent -LogName application -ComputerName esclogon03 -Credential local\Admin
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], EventLogException
    + FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWi
   nEventCommand

AND

Get-WinEvent : A security package specific error occurred
At line:1 char:1
+ Get-WinEvent -LogName application -ComputerName esclogon03 -Credential domain\admin ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], EventLogException
    + FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWi
   nEventCommand

Any ideas?  Below is the snipets of the function in question:

function DC1Appl {
$servername = "DC1"
$today = Get-Date
$date = $today.AddDays(-1)

$messageParameters = @{                        
                Subject = "DC1 APPLICATION Event log - $((Get-Date).ToShortDateString())"                       
                Body = get-eventlog application -computername $servername -entrytype Error,Warning -after $date |
                    ConvertTo-Html |                        
                    Out-String                       
                From = "<from@local>"                       
                To = "<TO@local>"                       
                SmtpServer = "<smtp.local>"                       
            }                        
            Send-MailMessage @messageParameters -BodyAsHtml
            
}


# Call the "DC1Appl" function.
DC1Appl

Thanks

Leon




Viewing all articles
Browse latest Browse all 21975

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>