Skip to content

Instantly share code, notes, and snippets.

@scuq
Created October 11, 2015 21:19
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save scuq/1c9c74a952da3aee06c8 to your computer and use it in GitHub Desktop.
Save scuq/1c9c74a952da3aee06c8 to your computer and use it in GitHub Desktop.
powershell remote read event log (Microsoft-Windows-WLAN-AutoConfig) for roaming event of client
Param ([string]$hostname=(Read-Host "Enter Hostname"))
[int]$lasthours=(Read-Host "How many hours of eventlog? default 8")
$addhours = 8;
if ($lasthours) {
$addhours = $lasthours
}
if ($hostname) {
$filter = @{ LogName = "Microsoft-Windows-WLAN-AutoConfig/Operational"
StartTime = [DateTime]::Now.AddHours($addhours*-1)
EndTime = [DateTime]::Now
}
Write-Host ([DateTime]::Now.AddHours($addhours*-1))
Write-Host ([DateTime]::Now)
$Events = Get-Winevent -FilterHashtable $filter -ComputerName $hostname
# Parse out the event message data
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = [xml]$Event.ToXml()
# Iterate through each one of the XML message properties
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {
# Append these as object properties
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text'
}
}
$Events | Select-Object id, MachineName, ProcessId,TimeCreated, Adapter, LocalMac, SSID, Cipher, Auth, PeerMac | Out-GridView
Read-Host "press enter to exit"
} else {
[System.Windows.Forms.MessageBox]::Show("Enter a hostname","No hostname entered",0)
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment