GetEventLog.ps1

# Define the path where you want to save the CSV file
$exportPath = "C:\temp\ExportLogs.csv"

# Get the current date and subtract 3 days
$startDate = (Get-Date).AddDays(-3)

# Define the log names
$applicationLog = "Application"
$systemLog = "System"

# Get events from Application log for the last 3 days
$applicationEvents = Get-WinEvent -LogName $applicationLog -After $startDate

# Get events from System log for the last 3 days
$systemEvents = Get-WinEvent -LogName $systemLog -After $startDate

# Combine the events from both logs
$allEvents = $applicationEvents + $systemEvents

# Select relevant properties for export
$selectedProperties = @{
    TimeCreated = 'TimeCreated'
    ID = 'Id'
    LevelDisplayName = 'LevelDisplayName'
    Message = 'Message'
}

# Export events to CSV
$allEvents | Select-Object $selectedProperties | Export-Csv -Path $exportPath -NoTypeInformation

Write-Host "Logs exported to $exportPath"

# Open the folder containing the CSV file
$exportFolder = Split-Path -Path $exportPath
Invoke-Item $exportFolder

RunEventExport.bat

@echo off
set PowerShellScriptPath=C:\temp\GetEventLogs.ps1

:: Check if running with elevated privileges
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

if %errorlevel% neq 0 (
    echo Run with elevated privileges...
    :: Relaunch script with elevated privileges
    powershell -Command "Start-Process '%PowerShellScriptPath%' -Verb RunAs"
) else (
    echo Running with elevated privileges...
    :: Run the PowerShell script
    powershell -File "%PowerShellScriptPath%"
)

pause