CODEWITHSUNDEEP
powershellevent-logget-eventlogget-winevent
Michał Sacharewicz
Michał Sacharewicz

Reputation: 172

Get-EventLog not parsing Message when run by SYSTEM user

Problem

I am trying to schedule a job that monitors events on remote machines.

I wrote the script based on the Get-EventLog command and it works properly when run by my account. But when I run the Get-EventLog as SYSTEM user, the .Message attribute of the returned objects shows the following error:

The description for Event ID '4724' in Source 'Microsoft-Windows-Security-Auditing' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event: {somedata}

When I use the Get-WinEvent command as SYSTEM user, the problem does not appear and the .Message part displays properly.

I would stick with Get-WinEvent, especially since the data is much easier to parse (thanks to the ToXML() method), but the Get-EventLog happens to be terribly faster :(

Question

Does anyone have any idea why the Get-EventLog fails to render .Message when run by SYSTEM user and perhaps how to fix it?

To avoid obvious answers:

Upvotes: 2

Views: 899

Answers (1)

Sully2_7
Sully2_7

Reputation: 1

Try: Get-WinEvent -LogName “Microsoft-Windows-Security-Auditing” | where ID -eq 4724 | select-object -ExpandProperty Message

Upvotes: 0

Related Questions