Get-WinEvent -ListLog * | ? { $_.RecordCount -gt 0 } | % { Get-WinEvent -LogName $_.LogName -MaxEvents 100 } | ? { $_.ToXml().Contains('text') }
If you need to look at events far in the past, you can adjust the -MaxEvents 100 or remove it entirely; the process will just take a while.
No comments:
Post a Comment