powershell PowerShell：使用QueryList过滤器查询Windows事件日志

Posted 2021-05-22

Clear-Host
$ComputerNames = ""

$FilterXml = @'
<QueryList>
      <Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
            <Select Path="Microsoft-Windows-TaskScheduler/Operational">
                  *[EventData/Data[@Name='TaskName']='\Subfolder']
            </Select>
      </Query>
</QueryList>
'@

foreach ($ComputerName In $ComputerNames) { 
      try {
            $events = Get-WinEvent -ComputerName $ComputerName -FilterXml $FilterXml -MaxEvents 2 -ErrorAction Stop
      } catch {
      Write-Warning -Message "Failed to query $($ComputerName) because $($_.Exception.Message)"
      }
}

$events | Select MachineName,TimeCreated,Id,TaskDisplayName | Format-Table -AutoSize