-Computername format?

I am trying to get Windows event logs remotely.

Get-WinEvent -FilterHashtable @{LogName='System'} -MaxEvents 10

works fine. However,

Get-WinEvent -FilterHashtable @{LogName='System';Computername='server';Credential='administrator'} -MaxEvents 10

gives a ‘No events were found that match the specified selection criteria’ msg. I get the same msg if I leave off the Credential parameter. I get the same results from a command line and in a .ps1 script. I’m using just the server name without the domain. The computer that I’m calling it from is on the same domain.

If you want to query another computer you will have to provide this computer “outside” your -FilterHashTable … like this:

Get-WinEvent -Computername ‘server’ -FilterHashtable @{LogName=‘System’} -MaxEvents 10

If the account you’re using to query has adminitrative rights on the computer you’re about to query you don’t need to provide credentials.

Thanks. That didn’t help, however. Same msg. The user does not have administrator rights. So, I’m trying to provide one. Do I have to qualify the user with the domain? BTW, I ran the same command (without the Computername or Credential from the computer itself (not remote) and it works fine.


Get-WinEvent -Computername 'name' -LogName 'System' -Credential 'username' -MaxEvents 10

works fine. Is the FilterHashTable syntax wrong?

Get-WinEvent -FilterHashtable @{LogName="System; Level=2} -Computername "name" -Credential "username" -MaxEvents 10

Seems to work. Apparently, what you have inside and outside the -FilterHashTable is important.