How to list a specific event under User Device Registration Event Log

Question

How to list a specific event under User Device Registration Event Log

T Crha 396

Hello,

I am trying to troubleshoot issues with workstation Azure hybrid join, and I need to look for specific events within that particular workstation (while connected remotely via PSSession).

If I use this:

(Get-WinEvent -ListProvider 'Microsoft-Windows-User Device Registration').Events

I am able to see a list of events related to Azure and MDM and so on, but I am not able to modify the cmdlet so it gives me the exact time of the event, along with its count.

Can you please help me to find out how to list those events along with the time they were actually logged?

Thank you,

Tomas

1 answer

Your answer

Answer 1

Limitless Technology 44,751

Hello there,

You can use the below PowerShell script to Compare the Time of an Event generated with the Current time.

$timeGenerated=(get-WinEvent @{LogName='Microsoft-windows-International/operational';id=1001} -maxevents 1).TimeGenerated

$diffMinutes=(New-TimeSpan $timeGenerated (Get-Date)).TotalMinutes

You can also use the Get-EventLog cmdlet gets events and event logs from local and remote computers. By default, Get-EventLog gets logs from the local computer. To get logs from remote computers, use the ComputerName parameter.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–

T Crha 396

Hello,

many thanks for your reply, but this is not working - when I am trying to use your method on the log that I need to see, it looks like this:
get-WinEvent @{LogName='Microsoft-Windows-User Device Registration';id=369}
get-WinEvent : There is not an event log on the localhost computer that matches "Microsoft-Windows-User Device Registration".

BAsically what I need is to be able to list through all the logs that I can see when I open eventViewer GUI (see screenshot)
eventvwr1

but the Powershell output that Get-EventLog cmdlet shows me is just like this:

PS C:\WINDOWS\system32> get-eventlog

cmdlet Get-EventLog at command pipeline position 1
Supply values for the following parameters:
LogName: *

  Max(K) Retain OverflowAction        Entries Log
  ------ ------ --------------        ------- ---
   2 048      0 OverwriteAsNeeded       3 206 Application
  20 480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 IntelAudioServiceLog
     512      7 OverwriteOlder              0 Internet Explorer
  20 480      0 OverwriteAsNeeded           0 Key Management Service
  16 384      0 OverwriteAsNeeded           0 Lync Server
     128      0 OverwriteAsNeeded         570 OAlerts
     512      7 OverwriteOlder          3 439 OneApp_IGCC
  51 200      0 OverwriteAsNeeded      80 416 Security
   2 048      0 OverwriteAsNeeded       3 576 System
  15 360      0 OverwriteAsNeeded      12 126 Windows PowerShell

Share via

How to list a specific event under User Device Registration Event Log

1 answer

Your answer