3

In Security section in Event Viewer, there is a column named "Computer".

I am using powershell to retrieve "all event ID 100" as of yesterday and display columns "event ID" and "computer".

Get-EventLog Security -After "2016-08-25 08:08:08" | Where-Object { ($_.instanceid) -eq 100 } | select-object "computer", "instanceID"

However, it only shows blank records for Computer column.

Please help. Thank you.

DAXaholic
  • 33,312
  • 6
  • 76
  • 74
York Mak
  • 231
  • 1
  • 3
  • 8

1 Answers1

4

Try it with MachineName like so 

... select-object "MachineName", "instanceID"

You can find that out when piping your objects to 

Get-EventLog ... | Get-Member

where you will find a property MachineName

DAXaholic
  • 33,312
  • 6
  • 76
  • 74