Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I originally assumed Get-WinEvent cannot be executed on Windows 2003, i.e. source computer must be Vista or later OS. However, it can be ran against a Windows 2003, from a Vista+ computer. It appears this is not the case - I tried the following options:

  1. Get-WinEvent from a Windows 7 to Windows 2003 in another domain.
  2. Get-WinEvent from a Windows 2008 R2 to Windows 2003 in the same domain.

Both show this error:

There are no more endpoints available from the endpoint mapper

Event log entries are extracted successfully in each of the above scenarios using Get-EventLog. runas /netonly /user:xxx powershell is required to connect with another domain.

Does it mean both source and target machine must be Vista+ or this error is unrelated to Get-WinEvent compatibility?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Get-WinEvent targets the event logs for Vista and newer OS's. The event log infrastructure was rebuilt then and allows for more advanced querying. Server 2003 and earlier do not support that type of query mechanism. Get-WinEvent can also target the new event logs generated by Event Tracing for Windows (ETW).

Get-EventLog will work against the older operating systems, as well as the new OS's, but cannot access the new logs and does not support the same querying capabilities. (And in my experience performs more slowly than Get-WinEvent.)

You should be able to use Get-WinEvent from any client computer that supports PowerShell V2, but the source of the event logs must be Vista or newer. Both the client and server must be Vista or newer.

share|improve this answer
    
Yes, speed is the problem - Get-WinEvent can be hundreds of times faster, depending on how many log entries you have. On my test Windows 2003 machine with 10K entries the script runs in 25 sec. My Windows 7 does the same for 40K entries in less than 0.5 sec. I just tried Win2003 -> Win2008r2 and got this error "Get-WinEvent : This cmdlet can run only on Microsoft Windows Vista and later versions of Windows." @ Powershell v2. So far it seems that both source AND target must be Vista+. –  Neolisk Sep 19 '12 at 15:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.