How to retrieve events from event logs with PowerShell and ADAudit Plus

Steps to retrieve events from event logs in Windows PowerShell

• Run the Get-WinEvent cmdlet. This returns 'classic logs' and 'Windows logs'. Classic logs are retrieved first.
• Specify the 'computer name' to retrieve logs from the local host. You can also specify a 'Recordcount' property to receive only logs that contain data.
  Code:

  Get-WinEvent -ListLog * -ComputerName localhost | Where-Object { $_.RecordCount }

   Copied
• Collecting logs from multiple servers
  You can also collect logs from multiple servers using a 'For Each' statement that creates a loop to retrieve logs from each server at a time.
  Code:

  $S = 'Server01', 'Server02', 'Server03'
  ForEach ($Server in $S) {
    Get-WinEvent -ListLog Application -ComputerName $Server |
      Select-Object LogMode, MaximumSizeInBytes, RecordCount, LogName,
        @{name='ComputerName'; expression={$Server}} |
      Format-Table -AutoSize
  }
  

   Copied
  Click to copy entire script

Steps to retrieve events from event logs in ADAudit Plus

• Login to ADAudit Plus web console using administrator credential. Navigate to the 'Server Audit' tab.
• Click on 'Server Audit Reports' and choose 'System Events'.

Screenshot: