我很難將屬性放入從事件日志匯出的資訊中。
$event0 = Get-WinEvent -FilterHashTable @{Logname = 'Security'; ID = 4663 }
$events = $event0 | Select | Where { $_.Properties[9].Value -eq 65536 }
$teste = foreach ($event in $events) {
$event2 = new-object psobject -Property @{
TimeCreated = $event.TimeCreated
EventID = $event.Id
User = $event.Properties[1].Value
Domain = $event.Properties[2].Value
LoginID = $event.Properties[3].Value
ObjectName = $event.Properties[6].Value
HandleID = $event.Properties[7].Value
ProcessName = $event.Properties[11].Value
AccessMASK = $event.Properties[9].Value
}
Write-Output "$($event2.TimeCreated), $($event2.EventId), $($event2.User), $($event2.Domain), $($event2.LoginID), $($event2.ObjectName), $($event2.HandleID), $($event2.ProcessName), $($event2.AccessMASK)"
$teste | ConvertTo-Html -Property TimeCreated, EventID, User, Domain, LoginID, ObjectName, HandleID, ProcessName, AccessMASK
}
$teste | Out-File -FilePath "Rel.html" -Append
結果顯示第一行中沒有屬性的資訊，該屬性用于描述每列中的資料。
uj5u.com熱心網友回復：
您需要Convert-HTML在整個結果串列上而不是在每個單獨的記錄上執行。
只有這樣，您才能在生成的 HTML 中獲得您所期望的標題。
$event0 = Get-WinEvent -FilterHashTable @{Logname = 'Security'; ID = 4663 }
$events = $event0 | Where { $_.Properties[9].Value -eq 65536 }
$teste = foreach ($event in $events) {
[PsCustomObject] @{
TimeCreated = $event.TimeCreated
EventID = $event.Id
User = $event.Properties[1].Value
Domain = $event.Properties[2].Value
LoginID = $event.Properties[3].Value
ObjectName = $event.Properties[6].Value
HandleID = $event.Properties[7].Value
ProcessName = $event.Properties[11].Value
AccessMASK = $event.Properties[9].Value
}
}
#Uncomment below if you want to see the result in the console.
#$teste | Format-Table
# Convert all results to a HTML table
$teste | ConvertTo-Html -Property TimeCreated, EventID, User, Domain, LoginID, ObjectName, HandleID, ProcessName, AccessMASK | Out-File -FilePath "Rel.html"
轉載請註明出處，本文鏈接：https://www.uj5u.com/qianduan/496661.html
標籤：电源外壳