Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the security logs by category or event number from the DC? please do let me know if any additional questions.

My Code:

$Eventlogs = Get-WmiObject -Class Win32_NTEventLogFile -ComputerName $computer
Foreach($log in $EventLogs)
        if($Log.LogFileName -eq "Security")
            $Now = [DateTime]::Now
            $FileName = "Security" +"_"+$Now.Month+$Now.Day+$Now.Year+"_"+$Now.Hour+$Now.Minute+$Now.Second
            $path = "\\{0}\c$\LogFolder\$folder\$FileName.evt" -f $Computer
            $ErrBackup = ($log.BackupEventLog($path)).ReturnValue
                if($ErrBackup -ne 0)
                    "Backup failed" 
                    "Backup Error was " + $ErrBackup

         Copy-EventLogsToArchive -path $path -Folder $Folder 
share|improve this question
Instead of scanning all of the logs, why don't you just start with Get-EventLog -LogName Security? – MooseBalm Oct 21 '13 at 16:40
@MooseBalm "Get-EventLog -LogName Security" is Skipping "Task Category" in the output, we need that. – Darktux Oct 21 '13 at 16:53
up vote 5 down vote accepted

It's not that Get-EventLog doesn't get the Task Category, it's just that it's not the default behavior of the Cmdlet to display it. But the data is still there.

Import-Module ActiveDirectory
foreach($server in Get-ADComputer -Filter *)
    Get-EventLog -LogName Security -ComputerName $server | ? { $_.CategoryNumber -EQ 12544 }

This is further complicated by the fact that the Task Categories are actually in numerical format - Event Viewer uses CategoryMessageFiles to translate the category numbers into category names.

You can find the location of the CategoryMessageFiles in the registry, at HKLM\System\CurrentControlSet\services\eventlog\Security\Security (there's a subkey for each event log.)

The reason it's done this way is to make it easy for developers to create their own event logs and their own task categories for their own applications.

Here's some developer documentation on how to get CategoryMessage strings, but I know you don't want to go through all that, so the next best thing would just be to find examples of the kind of events that you want to filter for, figure out their category numbers, and then do a Switch($_.CategoryNumber) on them to translate them into what ever strings you like.

Edit: Actually scratch all that. Ignore everything I just said. This should serve you much better:

Get-WMIObject -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security'" | Select EventCode, CategoryString
share|improve this answer
Excellent, thank you sounds about right. Do you know which key or policy defines the event log size on the server? our event logs are being overwritten within a hr, want to make them stick atleast for 3-5 hrs. – Darktux Oct 21 '13 at 19:26
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\{LogName}\MaxSize It's a DWORD. It seems possible a reboot may be required for changes made here to take effect; not sure. – Ryan Ries Oct 21 '13 at 19:29
Its set to Hexadecimal 1400000 , how can i translate it to MB? – Darktux Oct 21 '13 at 20:00
With Calculator.exe in Programmer mode... comes with Windows. – Ryan Ries Oct 21 '13 at 20:01
Got it, thank you. – Darktux Oct 21 '13 at 20:03

Sorry to break this to you but you can't do that (backup a filtered event log file to a new event log file) from the command line in Windows Server 2003.

You can export a subset of the events in an event log to XML or a CSV file.

You can use the Get-EventLog and filter all the events on Task Category with Where-Object. As Ryan has already pointed out, although the task category is not part of the default output, it's still there

The following example only works on Windows Server 2003 (R2 included), and returns all Security Log events in the categories "Logon/Logoff" and "Object Access"

Get-EventLog -LogName Security | Where-Object {@("Logon/Logoff","Object Access") -contains $_.Category}

This is easy to read and maintain, but doesn't perform very nice, since PowerShell fetches and serializes ALL event log entries, before filtering.

Building on Ryans example, let's use a WQL filter to accomplish it instead:

$events = Get-WMIObject -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND (CategoryString = 'Logon/Logoff' OR CategoryString = 'Object Access')"

To save the filtered events to file you can either export them as rows in a CSV file:

$events | Export-Csv C:\myEvents.csv -NoTypeInformation

or (if you have no problem compressing the backup but would like to keep message formatting) use the Export-CliXML cmdlet to output it to XML:

$events | Export-CliXML C:\myEvents.xml

You can then import them to the command-line when you need to search through them in the future:

$events = Import-CliXML C:\myEvents.xml

The XML output is serialized and requires a lot of storage, but since security log events are mostly filled with whitespace characters, disk space is easily reclaimed by zipping the files. I get a compression ratio of about 98% with an ordinary zip folder from an XML file containing approx. 200.000 security events.

You might be able to achieve even better compression with 7-zip

share|improve this answer
Sure, i will try your suggestions, our effort is to achieve passive backups for now and store them , so that if something happens in future we can come back and dig through. – Darktux Oct 21 '13 at 20:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.