-Computername format?

PowerShell Help
1

I am trying to get Windows event logs remotely.

Get-WinEvent -FilterHashtable @{LogName='System'} -MaxEvents 10

works fine. However,

Get-WinEvent -FilterHashtable @{LogName='System';Computername='server';Credential='administrator'} -MaxEvents 10

gives a ‘No events were found that match the specified selection criteria’ msg. I get the same msg if I leave off the Credential parameter. I get the same results from a command line and in a .ps1 script. I’m using just the server name without the domain. The computer that I’m calling it from is on the same domain.

2

If you want to query another computer you will have to provide this computer “outside” your -FilterHashTable … like this:

Get-WinEvent -Computername ‘server’ -FilterHashtable @{LogName=‘System’} -MaxEvents 10

If the account you’re using to query has adminitrative rights on the computer you’re about to query you don’t need to provide credentials.

3

Thanks. That didn’t help, however. Same msg. The user does not have administrator rights. So, I’m trying to provide one. Do I have to qualify the user with the domain? BTW, I ran the same command (without the Computername or Credential from the computer itself (not remote) and it works fine.

4

Hmmm.

Get-WinEvent -Computername 'name' -LogName 'System' -Credential 'username' -MaxEvents 10

works fine. Is the FilterHashTable syntax wrong?

5 
Get-WinEvent -FilterHashtable @{LogName="System; Level=2} -Computername "name" -Credential "username" -MaxEvents 10

Seems to work. Apparently, what you have inside and outside the -FilterHashTable is important.