powershell filterhashtable credential

Question

我在向代码字符串添加凭据时遇到问题。这样做的目的是从一台机器中提取多个日志，并按时间顺序打印日志。由于某种原因，一旦我添加了-credential，我就永远无法让get-winevent命令工作。欢迎任何意见！

$creds = Get-Credential -Message "Please enter creds"
$Startdate = Read-Host -Prompt "Input your start date in the format     of  mm/dd/yyyy hh:mm:ss am"

Try{
[DateTime]::Parse($Startdate, [System.Globalization.CultureInfo]::GetCultureInfo("en-US"))
}
Catch{
Write-Host "This time format is incorrect."
}
$Enddate = Read-Host -Prompt "Input your end date in the format of mm/dd/yyyy hh:mm:ss am"

Try{
[DateTime]::Parse($Enddate, [System.Globalization.CultureInfo]::GetCultureInfo("en-US"))
}
Catch{
Write-Host "This time format is incorrect."
}

$Logs = @()
do{
$input = (Read-Host "Please enter in the name of a log")
if($input -ne'') {$Logs += $input}
}
until($input -eq '')
$table = foreach ($Log in $Logs)  
{ 
Get-WinEvent -FilterHashtable @{LogName=$Log;StartTime=$Startdate;EndTime=$Enddate} -Credential $creds
}  
$table | sort TimeCreated  | Format-Table TimeCreated, Logname, Source, Message  -wrap

我当前收到的错误。

Get-WinEvent：试图执行未经授权的操作。第40行：40个字符：5+Get-WinEvent-FilterHashtable@｛LogName=$Log；StartTime=$Startdate…+~~~~~~ ~~~～~~~~ ~~~~ ~~ ~~~~～~~~~类别信息：未指定：(：([Get-WinEvent]，UnauthorizedAccessException+FullyQualifiedErrorId:System.UnauthorizedAccess异常，Microsoft.PowerShell.Commands.GetWinEventCommand

Answer 1

我认为错误来自于没有向-FilterHashtable提供$Startdate和$Enddate的正确数据类型。您可以检查用户输入是否为有效的DateTime格式，但变量本身仍为Strings。-FilterHashtable要求这些参数为DateTime对象，如下表所示：

Key name        Value data type
--------------- ---------------
LogName         <String[]>     
ProviderName    <String[]>     
Path            <String[]>     
Keywords        <Long[]>       
ID              <Int32[]>      
Level           <Int32[]>      
StartTime       <DateTime>     
EndTime         <DateTime>     
UserID          <SID>          
Data            <String[]>

试试这个：

$creds = Get-Credential -Message "Please enter creds"
# Create variable for parsed start date
[datetime]$Startdate = Get-Date
do {
$input = Read-Host -Prompt "Enter your start date. Use format 'mm/dd/yyyy hh:mm:ss am'"
# Check the user input
$success = ([DateTime]::TryParse($input, 
[System.Globalization.CultureInfo]::GetCultureInfo("en-US"),
[System.Globalization.DateTimeStyles]::None,
[ref]$Startdate)) 
} while (!$success)
# Create variable for parsed end date
[datetime]$Enddate = Get-Date
do {
$input = Read-Host -Prompt "Enter your end date. Use format 'mm/dd/yyyy hh:mm:ss am'"
# Check the user input
$success = ([DateTime]::TryParse($input, 
[System.Globalization.CultureInfo]::GetCultureInfo("en-US"),
[System.Globalization.DateTimeStyles]::None,
[ref]$Enddate)) 
} while (!$success)
$Logs = @()
while ($true) {
$logName = Read-Host -Prompt "Please enter in the name of a log"
if ([string]::IsNullOrEmpty($logName)) { break }
$Logs += $logName
}
$table = foreach ($Log in $Logs) { 
# note that we use [DateTime] objects $Startdate and $Enddate
Get-WinEvent -FilterHashtable @{LogName=$Log;StartTime=$Startdate;EndTime=$Enddate} -Credential $creds
}  
$table | Sort-Object TimeCreated  | Format-Table TimeCreated, Logname, Source, Message -Wrap