2

Problem

I am trying to schedule a job that monitors events on remote machines.

I wrote the script based on the Get-EventLog command and it works properly when run by my account. But when I run the Get-EventLog as SYSTEM user, the .Message attribute of the returned objects shows the following error:

The description for Event ID '4724' in Source 'Microsoft-Windows-Security-Auditing' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event: {somedata}

When I use the Get-WinEvent command as SYSTEM user, the problem does not appear and the .Message part displays properly.

I would stick with Get-WinEvent, especially since the data is much easier to parse (thanks to the ToXML() method), but the Get-EventLog happens to be terribly faster :(

Question

Does anyone have any idea why the Get-EventLog fails to render .Message when run by SYSTEM user and perhaps how to fix it?

To avoid obvious answers:

  • the COMPUTER$ account is member of DOMAIN\Event Log Readers group,
  • the COMPUTER$ account does have the read privileges over the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security on remote machines,
  • obviously, the registry entries for Microsoft-Windows-Security-Auditing and related DLL's are identical on both the source and target computers.
Michał Sacharewicz
  • 172
  • 2
  • 7
  • Since you are using `get-winevent` can you try passing -credential parameter – TheGameiswar Sep 29 '18 at 01:43
  • This seems related https://blogs.technet.microsoft.com/heyscriptingguy/2009/04/07/hey-scripting-guy-how-can-i-query-event-logs-to-discover-active-directory-information/ – TheGameiswar Sep 29 '18 at 01:43

1 Answers1

0

Try: Get-WinEvent -LogName “Microsoft-Windows-Security-Auditing” | where ID -eq 4724 | select-object -ExpandProperty Message

Sully2_7
  • 1
  • 1
  • As I have already explained, I do know that ``Get-WinEvent`` works. But it's terribly slow compared to ``Get-Eventlog`` and thus the question is specifically about the latter. – Michał Sacharewicz Jan 08 '19 at 11:05