Repository navigation
Expand file tree
/
Copy pathGet-ServiceStartModeEvent.ps1
More file actions
96 lines (90 loc) · 3.43 KB
/
Copy pathGet-ServiceStartModeEvent.ps1
File metadata and controls
96 lines (90 loc) · 3.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
Function Get-ServiceStartModeEvent {
<#
.SYNOPSIS
Finds all events related to a service startmode change in the event log.
.DESCRIPTION
Finds all events related to a service startmode change in the event log.
.PARAMETER Computername
Name of the computer to query
.PARAMETER Path
The full path to a specified event log that has been archived or saved to
a filesystem location.
.NOTES
Name: Get-ServiceStartModeEvent
Author: Boe Prox
Version History:
1.0 //Boe Prox - 07/08/2016
- Initial version
.EXAMPLE
Get-ServiceStartModeEvent -Computer $Env:Computername
Description
-----------
Displays all events related to service startmode changes.
#>
[cmdletbinding(
DefaultParameterSetName = 'Computer'
)]
Param (
[parameter(ParameterSetName='Computer')]
[string[]]$Computername = $env:COMPUTERNAME,
[parameter(ParameterSetName='File', ValueFromPipelineByPropertyName = $True)]
[Alias('Fullname')]
[string[]]$Path
)
Begin {
Write-Verbose $PSCmdlet.ParameterSetName
If ($PScmdlet.parametersetname -eq 'File') {
$Query = @"
<QueryList>
<Query Id="0" Path="file://TOREPLACE">
<Select Path="file://TOREPLACE">*[System[(EventID=7040)]]</Select>
</Query>
</QueryList>
"@
} Else {
$Query = @"
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*[System[(EventID=7040)]]</Select>
</Query>
</QueryList>
"@
}
}
Process {
Switch ($PScmdlet.ParameterSetName) {
'Computer' {
ForEach ($Computer in $Computername) {
Get-WinEvent -ComputerName $Computer -LogName System -FilterXPath $Query | ForEach {
$Properties = $_.Properties
[pscustomobject] @{
Computername = $_.MachineName
TimeCreated = $_.TimeCreated
Servicename = $Properties[0].Value
PriorStartMode = $Properties[1].Value
CurrentStartMode = $Properties[2].Value
ChangedBy = ([System.Security.Principal.SecurityIdentifier]$_.UserID).Translate([System.Security.Principal.NTAccount]).Value
}
}
}
}
'File' {
ForEach ($Item in $Path) {
$SearchQuery = $Query -Replace 'TOREPLACE',$Item
Write-Verbose $SearchQuery
Get-WinEvent -Path $Item -FilterXPath $SearchQuery | ForEach {
$Properties = $_.Properties
[pscustomobject] @{
Computername = $_.MachineName
TimeCreated = $_.TimeCreated
Servicename = $Properties[0].Value
PriorStartMode = $Properties[1].Value
CurrentStartMode = $Properties[2].Value
ChangedBy = ([System.Security.Principal.SecurityIdentifier]$_.UserID).Translate([System.Security.Principal.NTAccount]).Value
}
}
}
}
}
}
}