CODEWITHSUNDEEP
powershellget-winevent
Danish Hassan
Danish Hassan

Reputation: 1

I am trying to get event logs from multiple server but getting error

When I have 1 computer in $ComputerName it works but when I add another computer name it gives error.[Code & Error][1] Sorry about that, Following is the code:

$ComputerName = 'Server1','Server2' ForEach($Computer in $ComputerName){ $Info = Get-WinEvent -ComputerName $Computer -FilterHashTable @{Logname='System';ID=1074,6008,1076} | Sort-Object MachineName, TimeCreated, ID | Group-Object MachineName, TimeCreated, ID, Message | Select-Object @{N="Computer";E={$_.Group[0].MachineName}}, @{N="TimeCreated"; E={$.Group[0].TimeCreated}}, @{N="Error ID";E={$_.Group[0].ID}}, @{N="Message"; E={$.Group[0].Message.Replace("r",' ').Replace("n",' ')}} ` | Export-Csv -NoTypeInformation -Path C:\ServerLogs\events3.csv;}

ERROR:

Get-WinEvent : The RPC server is unavailable At C:\EventLogs\TEST.ps1:3 char:9

Upvotes: 0

Views: 3198

Answers (1)

OttScott
OttScott

Reputation: 21

"The RPC server is unavailable" usually indicates your RPC connection was blocked, either to Firewall or permissions issues. Rarely the RPC services have stopped on the remote host. Windows Firewall is most common in my experience and you can look to ensure your Firewall policy is set to allow 'Remote Event Log Management (RPC)' and that the rule is Enabled. There's a built-in rule to allow this. You shouldn't need to build a custom one. And I'd avoid the 'Remote Assistance' rule that some blogs mention. That can be a dangerous level of access.

Upvotes: 1

Related Questions