update
This commit is contained in:
@@ -0,0 +1,152 @@
|
||||
Function global:Set-WinEvtLog {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Enable/Disable an event log.
|
||||
.DESCRIPTION
|
||||
Enable or disable a Windows Event Log using the System.Diagnostics.Eventing.Reader.EventLogConfiguration object.
|
||||
This function only outputs terminating errors to the console. If you want to see more detail use -verbose
|
||||
.EXAMPLE
|
||||
Set-WinEvtLog -Enable -Log "Microsoft-Windows-DNS-Client/Operational"
|
||||
.EXAMPLE
|
||||
Set-WinEvtLog -Disable -Log (Get-Content ListOfLogs.txt)
|
||||
.EXAMPLE
|
||||
Get-Content ListOfLogs.txt | Set-WinEvtLog -Enable
|
||||
.PARAMETER Log
|
||||
The log(s) to modIfy.
|
||||
.PARAMETER Enable
|
||||
Enables the log(s).
|
||||
.PARAMETER Disable
|
||||
Disables the log(s).
|
||||
#>
|
||||
|
||||
[CmdletBinding(SupportsShouldProcess=$True,ConfirmImpact='Low')]
|
||||
param
|
||||
(
|
||||
[Parameter(Mandatory=$True,
|
||||
ValueFromPipeline=$False,
|
||||
ValueFromPipelineByPropertyName=$True,
|
||||
HelpMessage='Which log do you want to enable?')]
|
||||
[string[]]$Log,
|
||||
[Parameter(Mandatory=$True,
|
||||
ValueFromPipelineByPropertyName=$True,
|
||||
ParameterSetName = 'Enable')]
|
||||
[Switch]$Enable,
|
||||
[Parameter(Mandatory=$True,
|
||||
ValueFromPipelineByPropertyName=$True,
|
||||
ParameterSetName = 'Disable')]
|
||||
[Switch]$Disable
|
||||
)
|
||||
|
||||
Begin
|
||||
{
|
||||
# Keep track of changes made to event logs in a separate file.
|
||||
$RecordLog = "${Env:MSPDir}\Logs\WinEvtLogs-Enabled.log"
|
||||
|
||||
If ( !(Test-Path -Path $RecordLog) )
|
||||
{
|
||||
# Create the record keeping log file If it doesn't exist.
|
||||
$NewFile = ((New-Item -Path $RecordLog -ItemType file).name | Out-String)
|
||||
$NewFile = $NewFile.Trim()
|
||||
Write-Verbose "$NewFile did not exist and has been created."
|
||||
}
|
||||
}
|
||||
|
||||
Process
|
||||
{
|
||||
# Make sure Record Keeping is properly configured, otherwise exit.
|
||||
If ( !($RecordLog) )
|
||||
{
|
||||
Write-Verbose "The record keeping log does not exist, this function will not continue."
|
||||
Return
|
||||
}
|
||||
|
||||
# Loop through the name(s) in the $Log variable passed to this function.
|
||||
ForEach ($name in $Log)
|
||||
{
|
||||
# Process the data only If the script should Process data.
|
||||
If ( $pscmdlet.ShouldProcess($name, 'Enable Log') )
|
||||
{
|
||||
# Load the RecordLog into a variable.
|
||||
$PreviouslyEnabledLogs = Get-Content $RecordLog
|
||||
|
||||
# Determine whether to Enable or Disable logging of the specIfied log.
|
||||
Switch ($PSCmdlet.ParameterSetName)
|
||||
{
|
||||
'Enable' { $SetEnable = $True }
|
||||
'Disable' { $SetEnable = $False }
|
||||
}
|
||||
|
||||
# Create a new object for the specIfied log.
|
||||
$LogObject = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $name
|
||||
|
||||
# Set the variable to determine whether the log has been enabled by this script or not
|
||||
$IsEnabledByFunction = $False
|
||||
|
||||
# Determine whether or not the log had been enabled by this function.
|
||||
ForEach ($item in $PreviouslyEnabledLogs)
|
||||
{ If ($item -eq $name) { $IsEnabledByFunction = $True } }
|
||||
|
||||
# Act based on whether the log is already enabled or not.
|
||||
Switch ($logObject.IsEnabled)
|
||||
{
|
||||
$True
|
||||
{
|
||||
# Inform user whether this log has been enabled by this function or not.
|
||||
If ($IsEnabledByFunction)
|
||||
{ Write-Verbose "$name has previously been enabled by this function." }
|
||||
Else { Write-Verbose "$name has previously been enabled, but not by this function." }
|
||||
}
|
||||
|
||||
$False
|
||||
{
|
||||
# Inform user that this log has been disabled by something other than this function.
|
||||
If ($IsEnabledByFunction)
|
||||
{ Write-Verbose "$name should already be enabled by this function, but has been disabled by other means." }
|
||||
}
|
||||
}
|
||||
|
||||
# ModIfy the log to either enable or disable it.
|
||||
If ($LogObject.IsEnabled -eq $SetEnable)
|
||||
{ Write-Verbose "$name is already in the desired state." }
|
||||
Else
|
||||
{
|
||||
# Set the log to the desired state.
|
||||
$LogObject.IsEnabled = $SetEnable
|
||||
|
||||
# Save changes to the log.
|
||||
$LogObject.SaveChanges()
|
||||
|
||||
# VerIfy the change has been made.
|
||||
Switch ($LogObject.IsEnabled)
|
||||
{
|
||||
$True
|
||||
{
|
||||
Write-Verbose "$name has been enabled."
|
||||
|
||||
# Make sure this log wasn't already enabled by this function so we don't write the same name more than once in $RecordLog
|
||||
If (!($IsEnabledByFunction)) { Add-Content -Path $RecordLog "$name" }
|
||||
}
|
||||
|
||||
$False
|
||||
{
|
||||
# Remove $name from $RecordLog If it was put there by this function.
|
||||
If ($IsEnabledByFunction)
|
||||
{
|
||||
# Clear the contents of $RecordLog
|
||||
Clear-Content -Path $RecordLog
|
||||
|
||||
# Add each item back in that was already there except for the current $name
|
||||
ForEach ($filename In $PreviouslyEnabledLogs)
|
||||
{ If ($filename -ne $name) { Add-Content -Path $RecordLog $filename} }
|
||||
}
|
||||
Write-Verbose "$name has been disabled."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
end {}
|
||||
}
|
||||
Export-ModuleMember -Function Set-WinEvtLog
|
||||
Reference in New Issue
Block a user