Skip to content

Instantly share code, notes, and snippets.

@p0w3rsh3ll

p0w3rsh3ll/Get-WinEventLimit.ps1 Secret

Created December 27, 2019 17:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save p0w3rsh3ll/003a15f06699299427b6966c3d36a52c to your computer and use it in GitHub Desktop.
Save p0w3rsh3ll/003a15f06699299427b6966c3d36a52c to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Get-WinEventLimit.ps1
# There are 434 Query nodes in this XML query
([xml]$q).QueryList.Query | Measure
# A query with 257 Paths fails
Get-WinEvent -FilterXml (
[xml](
'<QueryList><Query>{0}</Query></QueryList>' -f "$(
(
Select-Xml -Xml ([xml]$q) -XPath '//Query' |
Select -First 257
).Node.InnerXML
)"
)
)
# A query with 256 Paths succeeds
Get-WinEvent -FilterXml ([xml]('<QueryList><Query>{0}</Query></QueryList>'-f "$((Select-Xml -Xml ([xml]$q) -XPath '//Query' | Select -First 256).Node.InnerXML)"))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment