Retrieving Event Logs Remotely

PowerShell v.2 has added remote capabilities to a number of cmdlets, including Get-EventLog. So now you are able to collect important events remotely with just one line:

You will need to have local admin privileges on the target machine to successfully retrieve the information remotely. If you use UAC, you should make sure to run this command from an elevated PowerShell console. In addition, some remote techniques require certain prerequisites on the target machine that you want to access. For example, Get-EventLog can only retrieve the information if the target machine runs the "Remote Registry" service.

ReTweet this Tip!