Hi all,
looking to change one of my scripts to use Get-WinEvent in place of Get-EventLog. testing the command to see what properties are returned so I can update the script something unexpected happened.
Get-WinEvent : Attempted to perform an unauthorized operation.
At line:1 char:24
+ $applogs = get-winevent <<<< -logname application
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], UnauthorizedAc
cessException
+ FullyQualifiedErrorId : Attempted to perform an unauthorized operation.,
Microsoft.PowerShell.Commands.GetWinEventCommand
Before anyone states the obvious - yes I am running this in an elevated prompt.
Now here's the odd part, if I create two arrays - one using "get-winevent -logname application -computer RemoteServer" and another using "get-eventlog -computer RemoteServer Application" the first one errors roughly 20 times, the second no errors. if I allow both to complete (running at the same time) both have the same item count of 64855. Same errors occur if I logon to "remoteserver" and run it locally.
I'm assuming that its an issue with specific event logs, anyone have suggestions on how to troubleshoot this?
Thanks in advance.