152 lines
6.2 KiB
PowerShell
152 lines
6.2 KiB
PowerShell
|
Function global:Set-WinEvtLog {
|
||
|
|
<#
|
||
|
|
.SYNOPSIS
|
||
|
|
Enable/Disable an event log.
|
||
|
|
.DESCRIPTION
|
||
|
|
Enable or disable a Windows Event Log using the System.Diagnostics.Eventing.Reader.EventLogConfiguration object.
|
||
|
|
This function only outputs terminating errors to the console. If you want to see more detail use -verbose
|
||
|
|
.EXAMPLE
|
||
|
|
Set-WinEvtLog -Enable -Log "Microsoft-Windows-DNS-Client/Operational"
|
||
|
|
.EXAMPLE
|
||
|
|
Set-WinEvtLog -Disable -Log (Get-Content ListOfLogs.txt)
|
||
|
|
.EXAMPLE
|
||
|
|
Get-Content ListOfLogs.txt | Set-WinEvtLog -Enable
|
||
|
|
.PARAMETER Log
|
||
|
|
The log(s) to modIfy.
|
||
|
|
.PARAMETER Enable
|
||
|
|
Enables the log(s).
|
||
|
|
.PARAMETER Disable
|
||
|
|
Disables the log(s).
|
||
|
|
#>
|
||
|
|
|
||
|
|
[CmdletBinding(SupportsShouldProcess=$True,ConfirmImpact='Low')]
|
||
|
|
param
|
||
|
|
(
|
||
|
|
[Parameter(Mandatory=$True,
|
||
|
|
ValueFromPipeline=$False,
|
||
|
|
ValueFromPipelineByPropertyName=$True,
|
||
|
|
HelpMessage='Which log do you want to enable?')]
|
||
|
|
[string[]]$Log,
|
||
|
|
[Parameter(Mandatory=$True,
|
||
|
|
ValueFromPipelineByPropertyName=$True,
|
||
|
|
ParameterSetName = 'Enable')]
|
||
|
|
[Switch]$Enable,
|
||
|
|
[Parameter(Mandatory=$True,
|
||
|
|
ValueFromPipelineByPropertyName=$True,
|
||
|
|
ParameterSetName = 'Disable')]
|
||
|
|
[Switch]$Disable
|
||
|
|
)
|
||
|
|
|
||
|
|
Begin
|
||
|
|
{
|
||
|
|
# Keep track of changes made to event logs in a separate file.
|
||
|
|
$RecordLog = "${RecordKeepingDir}\WinEvtLogs-Enabled.log"
|
||
|
|
|
||
|
|
If ( !(Test-Path -Path $RecordLog) )
|
||
|
|
{
|
||
|
|
# Create the record keeping log file If it doesn't exist.
|
||
|
|
$NewFile = ((New-Item -Path $RecordLog -ItemType file).name | Out-String)
|
||
|
|
$NewFile = $NewFile.Trim()
|
||
|
|
Write-Verbose "$NewFile did not exist and has been created."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
Process
|
||
|
|
{
|
||
|
|
# Make sure Record Keeping is properly configured, otherwise exit.
|
||
|
|
If ( !($RecordLog) )
|
||
|
|
{
|
||
|
|
Write-Verbose "The record keeping log does not exist, this function will not continue."
|
||
|
|
Return
|
||
|
|
}
|
||
|
|
|
||
|
|
# Loop through the name(s) in the $Log variable passed to this function.
|
||
|
|
ForEach ($name in $Log)
|
||
|
|
{
|
||
|
|
# Process the data only If the script should Process data.
|
||
|
|
If ( $pscmdlet.ShouldProcess($name, 'Enable Log') )
|
||
|
|
{
|
||
|
|
# Load the RecordLog into a variable.
|
||
|
|
$PreviouslyEnabledLogs = Get-Content $RecordLog
|
||
|
|
|
||
|
|
# Determine whether to Enable or Disable logging of the specIfied log.
|
||
|
|
Switch ($PSCmdlet.ParameterSetName)
|
||
|
|
{
|
||
|
|
'Enable' { $SetEnable = $True }
|
||
|
|
'Disable' { $SetEnable = $False }
|
||
|
|
}
|
||
|
|
|
||
|
|
# Create a new object for the specIfied log.
|
||
|
|
$LogObject = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $name
|
||
|
|
|
||
|
|
# Set the variable to determine whether the log has been enabled by this script or not
|
||
|
|
$IsEnabledByFunction = $False
|
||
|
|
|
||
|
|
# Determine whether or not the log had been enabled by this function.
|
||
|
|
ForEach ($item in $PreviouslyEnabledLogs)
|
||
|
|
{ If ($item -eq $name) { $IsEnabledByFunction = $True } }
|
||
|
|
|
||
|
|
# Act based on whether the log is already enabled or not.
|
||
|
|
Switch ($logObject.IsEnabled)
|
||
|
|
{
|
||
|
|
$True
|
||
|
|
{
|
||
|
|
# Inform user whether this log has been enabled by this function or not.
|
||
|
|
If ($IsEnabledByFunction)
|
||
|
|
{ Write-Verbose "$name has previously been enabled by this function." }
|
||
|
|
Else { Write-Verbose "$name has previously been enabled, but not by this function." }
|
||
|
|
}
|
||
|
|
|
||
|
|
$False
|
||
|
|
{
|
||
|
|
# Inform user that this log has been disabled by something other than this function.
|
||
|
|
If ($IsEnabledByFunction)
|
||
|
|
{ Write-Verbose "$name should already be enabled by this function, but has been disabled by other means." }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# ModIfy the log to either enable or disable it.
|
||
|
|
If ($LogObject.IsEnabled -eq $SetEnable)
|
||
|
|
{ Write-Verbose "$name is already in the desired state." }
|
||
|
|
Else
|
||
|
|
{
|
||
|
|
# Set the log to the desired state.
|
||
|
|
$LogObject.IsEnabled = $SetEnable
|
||
|
|
|
||
|
|
# Save changes to the log.
|
||
|
|
$LogObject.SaveChanges()
|
||
|
|
|
||
|
|
# VerIfy the change has been made.
|
||
|
|
Switch ($LogObject.IsEnabled)
|
||
|
|
{
|
||
|
|
$True
|
||
|
|
{
|
||
|
|
Write-Verbose "$name has been enabled."
|
||
|
|
|
||
|
|
# Make sure this log wasn't already enabled by this function so we don't write the same name more than once in $RecordLog
|
||
|
|
If (!($IsEnabledByFunction)) { Add-Content -Path $RecordLog "$name" }
|
||
|
|
}
|
||
|
|
|
||
|
|
$False
|
||
|
|
{
|
||
|
|
# Remove $name from $RecordLog If it was put there by this function.
|
||
|
|
If ($IsEnabledByFunction)
|
||
|
|
{
|
||
|
|
# Clear the contents of $RecordLog
|
||
|
|
Clear-Content -Path $RecordLog
|
||
|
|
|
||
|
|
# Add each item back in that was already there except for the current $name
|
||
|
|
ForEach ($filename In $PreviouslyEnabledLogs)
|
||
|
|
{ If ($filename -ne $name) { Add-Content -Path $RecordLog $filename} }
|
||
|
|
}
|
||
|
|
Write-Verbose "$name has been disabled."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
end {}
|
||
|
|
}
|
||
|
|
Export-ModuleMember -Function Set-WinEvtLog
|