Hi All
I have a script that retrieves event log from various servers each morning. It has been working fine for the last 3 years. However, during the last few days, I noticed that script is failing to retrieve the event logs from one particular domain controller. Upon investigation (running in Elevated shell) I received the following message:
get-eventlog : Attempted to perform an unauthorized operation.
At line:31 char:1
+ get-eventlog application -computername $servername -entrytype Error,Warning -aft ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-EventLog], UnauthorizedAccessException
+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetEventLogCommand
This script runs on my Win8.1 workstation. As a test, I ran the function on a Win7 (my old workstation which ran this script in the past) device, with same results. Strange thing is, the second DC in the domain appears to produce event logs via the script just fine. These DC's are identical Win 2008 R2 Domain Controllers, and no WSUS updates applied in the last week to either device.
Now, I've seen a few forums discussing this, but no real fix or advice. I tried Get-Winevent as suggested in one post, using the -Credential switch, but failed as well. And yes, I have Admin and Domain Admin and Enterprise Admin rights on this domain (all my credentials fail):
Get-WinEvent : A security package specific error occurred
At line:1 char:1
+ Get-WinEvent -LogName application -ComputerName esclogon03 -Credential local\Admin
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], EventLogException
+ FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWi
nEventCommand
AND
Get-WinEvent : A security package specific error occurred
At line:1 char:1
+ Get-WinEvent -LogName application -ComputerName esclogon03 -Credential domain\admin ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], EventLogException
+ FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWi
nEventCommand
Any ideas? Below is the snipets of the function in question:
function DC1Appl {
$servername = "DC1"
$today = Get-Date
$date = $today.AddDays(-1)
$messageParameters = @{
Subject = "DC1 APPLICATION Event log - $((Get-Date).ToShortDateString())"
Body = get-eventlog application -computername $servername -entrytype Error,Warning -after $date |
ConvertTo-Html |
Out-String
From = "<from@local>"
To = "<TO@local>"
SmtpServer = "<smtp.local>"
}
Send-MailMessage @messageParameters -BodyAsHtml
}
# Call the "DC1Appl" function.
DC1Appl
Thanks
Leon