Looks like below code does not work

$EventLogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4    908","4964"
$MultipleIDLogEntries={Get-WinEvent -FilterHashtable     @{Logname='security';Id=@($using:EventLogonIDs)}}
Get-PSSession | % {icm -Session $_ -Command $MultipleIDLogEntries}

it returns below for each server

No events were found that match the specified selection criteria. + CategoryInfo : ObjectNotFound: (:) [Get-WinEvent], Exception + FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand + PSComputerName : testitservice.cloudapp.net

But if $EventLogonIDs="4624", it just works with no issues.

What is wrong? Thanks!

  • Why do you have spaces between 4 and 908? – Greg Askew Aug 3 '15 at 22:07
  • No, this is because of indentation here. I did not get right away how to indent code block correctly – Andrey Vernigora Aug 4 '15 at 8:25
  • On the other hand it works this way $MultipleIDLogEntries={$using:EventLogonIDs | % {Get-WinEvent -FilterHashtable @{Logname='security';Id=$_}}} Get-PSSession | % {icm -Session $_ -Command $MultipleIDLogEntries} – Andrey Vernigora Aug 4 '15 at 9:09
  • nope it does not, it getting stuck – Andrey Vernigora Aug 4 '15 at 10:07
  • @AndreyVernigora I've seen this before, where FilterHashtable.Id only takes up to 23 numerical arguments, any more and it immediately returns with no "NoMatchingEventsFound" error. If you cut down the list to, say, 10 event id's, does it work? – Mathias R. Jessen Aug 4 '15 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.