I'm a domain admin equivalent, I've tried running in an elevated console (right-click> run as administrator), and I'm consistently getting errors when executing

get-winevent -logname application | where {$_.message -match "Faulting application"} | `
                                    select TimeCreated,message

I'll get three lines of result, then

Get-WinEvent : Attempted to perform an unauthorized operation.
At line:1 char:13 Get-WinEvent : Attempted to perform an unauthorized operation.
 + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], UnauthorizedAccessException
 + FullyQualifiedErrorId : Attempted to perform an unauthorized operation.,Microsoft.PowerShell.Commands.GetWinEventCommand

This seems to be a new development, haven't gotten those errors before.

It's consistent - if I run it with -computername from another server, the pattern still goes 3 OK lines, then X errors, then 5 OK lines, etc.

  • 1
    What operating system and version of PowerShell are you running? (gwmi Win32_OperatingSystem).Version and Get-Host
    – Chris S
    Feb 12, 2014 at 21:17
  • Windows Server 2008 R2 + SP1, Powershell 2.0
    – user209162
    Feb 13, 2014 at 22:00
  • is this being run from an elevated powershell prompt?
    – MDMoore313
    Feb 24, 2014 at 21:58
  • From get-help get-winevent Note: [...] And, it requires the Microsoft .NET Framework 3.5 or a later version. Do you meet this requirment ?
    – Brice
    Feb 28, 2014 at 8:32
  • 1
    Yes, this is from an elevated shell.
    – user209162
    Feb 28, 2014 at 20:50

5 Answers 5


Does it happen with other Event Logs? For instance what if you run the following to view login events with specific event IDs?:

Get-WinEvent -FilterHashtable @{logname='security'; id=@(4624,4634,4672,4648)}

If that works there may be some items in the application event log that you don't have access to. In that case you would have to use something like Process Monitor to find out why your access is being denied.

You may get better results using the FilterHashtable parameter to pass the filter criteria to the Get-WinEvent cmdlet. See http://ss64.com/ps/get-winevent.html for examples.


I can run this with a non-administrative user on a locked-down system. Check your permissions and audit policies for event logs in GPO. You may have it set so ONLY auditors can see the logs. Good luck troubleshooting if that is the case.


I had this issue with the Security log. No entries would be returned from a remote get-winevent -logname security. The user was able to access the remote security eventlog via eventvwr.msc.

The fix was a reg hack - add a permission to this key:


I added the AD group of the user with read access and get-winevent worked perfectly after that.


My solution was to add the user / group to the local "Event Log Readers" Group. Log off, back in. Even if the user was already an administrator.


I found another scenario to trigger this error.

  1. Is your Get-WinEvent call using the ComputerName parameter?
  2. Is the destination address a DNS Alias (CNAME record)?

If the above items are true, try using the IP address instead.

That was the change that solved my problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.