Reading event log remotely with Get-EventLog in Powershell

powershell powershell-remoting cmdlets
Korki Korkig picture Korki Korkig · May 28, 2013 · Viewed 40.6k times · Source

I've a powershell script which runs on server(test-server) and reads the log file of his client(DC1).

  • Both sides can ping to each other.
  • On both sides, firewalls are disabled.

  • Remote Desktop and Remote Assistance are enabled on DC1.

    Get-EventLog System -ComputerName test-server -Source Microsoft-Windows-Winlogon # WORKS
Get-EventLog System -ComputerName DC1 -Source Microsoft-Windows-Winlogon # DOESN'T WORK

I run this script on test-server. As you see when I read the local log file on test-server it works fine but if I try to read the log file of DC1 remotely I get the error "Get-EventLog : The network path was not found.".

Screenshot of the error: enter image description here

How can I avoid this error and read the log file of DC1 from test-server with using Get-EventLog?

Answer

Korki Korkig picture Korki Korkig · May 29, 2013

@Lars Truijens's suggestion solved my issue. But other suggestions are also important to check.

So, here is the checklist if you get this kind of error when you try to get log files remotely:

  • Disable or set firewall settings on both sides.
  • Enable Remote Desktop and Remote Assistance on client machine.
  • Can you ping to the client machine?
  • Run dir \\dc1\c$ to see that you are allowed to reach to the harddisk. (@Shay Levy's suggestion)
  • Run Get-Service -ComputerName YOURCOMPUTERNAME to see that you are allowed to reach to the services. (@Shay Levy's suggestion)
  • Start the Remote Registry service. (@Lars Truijens's suggestion and this made it work for me)

Here is the screenshot of this solution: SolutionScreenshot

Related questions

Using PowerShell credentials without being prompted for a password

I'd like to restart a remote computer that belongs to a domain. I have an administrator account but I don't know how to use it from powershell. I know that there is a Restart-Computer cmdlet and that I can pass …

Read More
Powershell remoting with ip-address as target

I successfully enabled PSRemoting on my Server 2008 R2. I'm able to do a remote-pssession from within the same network using the hostname as target. I'm failing when I try to use the IP-Address as target from any computer (within the …

Read More
Stop Powershell from exiting

I know that there is that little -noexit switch for PowerShell. Is there anyway of staying in the shell without using that switch? In other words, I want a script command(s) that executes then leaves the shell open.

Read More