Powershell Event Log

DaveM1980 · 2017-02-07T14:08:19.000Z

Hey Spiceheads!

Simple one I’m sure from a PowerShell noob! I have this powershell script:

Get-EventLog -log security | Where-Object {$_.EventID -eq 4740} | fl

Which works fine. However, if I add “-newest 5” to show the last 5 events, he no work !
Get-EventLog -log security -Newest 5 | Where-Object {$_.EventID -eq 4740} | fl

Can someone direct me on how I would go about showing the last few event id’s 4740 ?

Dave

craigduff · 2017-02-07T14:11:49.000Z

Get-WinEvent -MaxEvents 5 -FilterHashtable @{
    'LogName' = 'Security'
    'Id' = 4740
}

I like to use Get-WinEvent instead of Get-EventLog.

The reason what you posted doesn’t work is that you are getting the last 5 of ANY event in the security log and then filtering those five to just 4740. The last 5 might contain less than 5 or even 0 4740 events. So you have to do the filtering for 4740 with get-winevent or get-eventlog.

Get-EventLog equiv:

Get-EventLog -LogName Security -InstanceId 4740 -Newest 5