Get Taskscheduler Geschichte - Ebene mithilfe von Powershell

Question

Wie kann ich den Taskscheduler Niveau in der Geschichte mithilfe von Powershell

Answer 1

$EventFilter = @{ 
    LogName = 'Microsoft-Windows-TaskScheduler/Operational' 
    Id = 100 
    StartTime = [datetime]::Now.AddDays(-1) 
} 
# PropertySelector for the Correlation id (the InstanceId) and task name 
[string[]]$PropertyQueries = @(
    'Event/EventData/Data[@Name="InstanceId"]' 
    'Event/EventData/Data[@Name="TaskName"]' 
) 
$PropertySelector = New-Object System.Diagnostics.Eventing.Reader.EventLogPropertySelector @(,$PropertyQueries) 
# Loop through the start events 
$TaskInvocations = foreach($StartEvent in Get-WinEvent -FilterHashtable $EventFilter){ 
    # Grab the InstanceId and Task Name from the start event 
    $InstanceId,$TaskName = $StartEvent.GetPropertyValues($PropertySelector) 

    # Create custom object with the name and start event, query end event by InstanceId 
    [pscustomobject]@{ 
     TaskName = $TaskName 
     StartTime = $StartEvent.TimeCreated 
     EndTime = $(Get-WinEvent -FilterXPath "*[System[(EventID=102)] and EventData[Data[@Name=""InstanceId""] and Data=""{$InstanceId}""]]" -LogName 'Microsoft-Windows-TaskScheduler/Operational' -ErrorAction SilentlyContinue).TimeCreated 
    } 
} 
$TaskInvocations 

Referenzverweis: TaskScheduler History

Hoffe, es hilft.