How to retrieve events from event logs with PowerShell and ADAudit Plus

The Get-WinEvent cmdlet is a descendant of the original Get-EventLog cmdlet. It comes with the additional capability of retrieving 'Applications Logs' and 'Services Logs'. It also comes with a difference in properties in comparison with Get-EventLog. Get-WinEvent gives you extensive information about the logs stored on your system. This cmdlet offers you three means to request your data using

FilterXML
FilterHashtable
FilterXPath

Despite the good performance Get-WinEvent provides to retrieve your data, it still makes sense to look for a quicker solution that requires less effort but also delivers in-depth event log reports. ADAudit Plus is one such solution that comes with an easy interface to identify relevant reports. It comes with a built-in search functionality to easily trace out specific events. The following is a comparison that shows how you can retrieve event logs using PowerShell an ADAudit Plus.

Windows PowerShell

Steps to retrieve events from event logs in Windows PowerShell

Run the Get-WinEvent cmdlet. This returns 'classic logs' and 'Windows logs'. Classic logs are retrieved first.
Specify the 'computer name' to retrieve logs from the local host. You can also specify a 'Recordcount' property to receive only logs that contain data.
Code:
```
Get-WinEvent -ListLog * -ComputerName localhost | Where-Object { $_.RecordCount }
```
Copied

Collecting logs from multiple servers
You can also collect logs from multiple servers using a 'For Each' statement that creates a loop to retrieve logs from each server at a time.
Code:

$S = 'Server01', 'Server02', 'Server03'
ForEach ($Server in $S) {
  Get-WinEvent -ListLog Application -ComputerName $Server |
    Select-Object LogMode, MaximumSizeInBytes, RecordCount, LogName,
      @{name='ComputerName'; expression={$Server}} |
    Format-Table -AutoSize
}

Copied

Click to copy entire script

ADAudit Plus

Steps to retrieve events from event logs in ADAudit Plus

Login to ADAudit Plus web console using administrator credential. Navigate to the 'Server Audit' tab.
Click on 'Server Audit Reports' and choose 'System Events'.

Screenshot:

Why ADAudit Plus is the better solution for you?

Comprehensive dashboard, so you can correlate reports.
It allows you to export reports in the desired format (CSV, HTML, XLS, PDF) with a single click easily.
Advanced filter options to save you the trouble of creating complex LDAP queries.

Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
US
By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
Thanks!
Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Active Directory auditing

Windows file auditing

NAS device file auditing

Windows server auditing

Workstation auditing

Entra ID auditing

All features →

Help documents

Video zone

Webinars

Product brochures

Case studies

E-books

Awards zone

Study

How tos

Best practices

How to retrieve events from event logs with PowerShell and ADAudit Plus

Windows PowerShell

Steps to retrieve events from event logs in Windows PowerShell

ADAudit Plus

Steps to retrieve events from event logs in ADAudit Plus

Related Resources

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

How to retrieve events from event logs with PowerShell and ADAudit Plus

Windows PowerShell

Steps to retrieve events from event logs in Windows PowerShell

ADAudit Plus

Steps to retrieve events from event logs in ADAudit Plus

Related Resources

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure