How to select-object task category from event-logs through powershell

Rakesh Sharma 56 Reputation points
2021-08-25T14:32:45.853+00:00

How to select-object (Task category) in event logs.

For example :

Get-eventlog -LogName Security -After '8/15/2021 1:17:00' | where-object {$_.Category -like "removable storage"}

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,407 questions
0 comments No comments
{count} votes

Accepted answer
  1. Michael Taylor 49,251 Reputation points
    2021-08-25T15:39:01.627+00:00

    The 'Task Category' you see in the UI is based upon the language of the OS. Under the hood an event just has a category ID. The UI maps it to the localized name for convenience. Personally I think you should stick with the ID as it is consistent across locales and will work even from remote machines.

    You are not, at this time, able to filter on task category strings as this information isn't directly stored in the event source that Get-EventLog (or even the newer Get-WinEvent) commandlets use. The ID is the most efficient approach. But note that it is not recommended that you use Where-Object with Get-EventLog (or anything that returns lots of data) because it is a filter. It is applied AFTER the previous pipeline command executes and therefore you're retrieving ALL the event log data and then filtering in PS from there. The better option is to do the filtering using the Get-EventLog filtering support directly. However you won't be able to filter by named category as that isn't stored in the event log data.

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Andreas Baumgarten 98,626 Reputation points MVP
    2021-08-25T15:39:16.38+00:00

    Hi @RocxieDan-0063 ,

    please try this:

    Get-EventLog -LogName Security -After '8/15/2021 1:17:00' | Where-Object {$_.Category -match 12812} 
    

    I found the number 12812 for the removable storage category here: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwintqmSt8zyAhXWhv0HHV3pA_sQFnoECBYQAQ&url=https%3A%2F%2Fdownload.microsoft.com%2Fdownload%2F6%2F0%2Fb%2F60b27ded-705a-4751-8e9f-642e635c3cf3%2Fmicrosoft%2520windows%25208%2520windows%2520server%25202012%2520common%2520criteria%2520supplemental%2520admin%2520guidance.docx&usg=AOvVaw3rQxNXMeNTUHjL1mdr1tU0


    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Andreas Baumgarten

    0 comments No comments