Skip to content

Instantly share code, notes, and snippets.

@VimalShekar
Created January 15, 2018 18:01
Show Gist options
  • Save VimalShekar/0513fe1170be0b818bbf6d63713b7198 to your computer and use it in GitHub Desktop.
Save VimalShekar/0513fe1170be0b818bbf6d63713b7198 to your computer and use it in GitHub Desktop.
Enabling or Disabling a given Event Viewer Channel using Powershell
#
# Function to enable or disable Event channels in Windows
#
function ConfigureEventChannel
{
param(
[string] $logName,
[switch] $Disable
)
$bIsDotNet35Above = IsDotNetVersion35
Write-host "ConfigureEventChannel: $($LogNameArray.Count) channels in array..." | Out-Null
#foreach($logName in $LogNameArray)
#{
if([string]::IsNullOrEmpty($logName))
{
Write-host "ConfigureEventChannel: Logname was empty..." | Out-Null
continue
}
try {
if( $bIsDotNet35Above ) {
$log = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $logName
if($Disable)
{
Write-host "ConfigureEventChannel: Setting $logName to disabled state..." | Out-Null
$log.IsEnabled=$false
} else {
Write-host "ConfigureEventChannel: Setting $logName to enabled state..." | Out-Null
$log.IsEnabled=$true
}
$log.SaveChanges()
Write-host "ConfigureEventChannel: Operation completed..." | Out-Null
}
else {
if($Disable)
{
Write-host "ConfigureEventChannel: Setting $logName to disabled state..." | Out-Null
Execute-Cmd -CmdTool "C:\Windows\System32\wevtutil.exe" -ArgumentsToExecute "sl $logName /e:false"
} else {
Write-host "ConfigureEventChannel: Setting $logName to enabled state..." | Out-Null
Execute-Cmd -CmdTool "C:\Windows\System32\wevtutil.exe" -ArgumentsToExecute "sl $logName /e:true"
}
Write-host "ConfigureEventChannel: Operation completed..." | Out-Null
}
}
catch {
Write-host "ConfigureEventChannel: Exception when trying to enable $logName channel -- Details: $($_.Exception.Message)" | Out-Null
}
}
# Sample Usage:
#
# To enable admin logging for Windows print Service
# ConfigureEventChannel -Logname "Microsoft-Windows-PrintService/Admin"
#
# To disable
# ConfigureEventChannel -Logname "Microsoft-Windows-PrintService/Admin" -Disable
#
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment