I'm a domain admin equivalent, I've tried running in an elevated console (right-click> run as administrator), and I'm consistently getting errors when executing
get-winevent -logname application | where {$_.message -match "Faulting application"} | `
select TimeCreated,message
I'll get three lines of result, then
Get-WinEvent : Attempted to perform an unauthorized operation.
At line:1 char:13 Get-WinEvent : Attempted to perform an unauthorized operation.
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], UnauthorizedAccessException
+ FullyQualifiedErrorId : Attempted to perform an unauthorized operation.,Microsoft.PowerShell.Commands.GetWinEventCommand
This seems to be a new development, haven't gotten those errors before.
It's consistent - if I run it with -computername from another server, the pattern still goes 3 OK lines, then X errors, then 5 OK lines, etc.
(gwmi Win32_OperatingSystem).Version
andGet-Host
get-help get-winevent
Note: [...] And, it requires the Microsoft .NET Framework 3.5 or a later version.
Do you meet this requirment ?