get Event Log Forwarder Subscribers with powershell

Question

I want to get a list of subscribers for specific source initiated Event log forwarder subscriptions. Is there a way to get this in powershell?

Eventually I want to to develop a script that will tell me when a new subscriber is added.
It would also be nice if it would be possible to identify which subscribers are active and inactive.

I know they are all in the registry (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Subscriptions{Subscription Name}\EventSources{Machine Name}

If that is the only way to enumerate a list, does anyone know how to identify which are active?

Answer 1

Hi,

Does this meet your needs? The creation time of a subscription is not recorded in the registry.

$path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Subscriptions"  
Get-ChildItem -Path $path|Select-Object -Property PSChildName,@{name='Enabled';expression={($_|Get-ItemProperty -Name Enabled).Enabled}}  

Best Regards，
Ian Xue

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.