Function global:Set-WinEvtLog { <# .SYNOPSIS Enable/Disable an event log. .DESCRIPTION Enable or disable a Windows Event Log using the System.Diagnostics.Eventing.Reader.EventLogConfiguration object. This function only outputs terminating errors to the console. If you want to see more detail use -verbose .EXAMPLE Set-WinEvtLog -Enable -Log "Microsoft-Windows-DNS-Client/Operational" .EXAMPLE Set-WinEvtLog -Disable -Log (Get-Content ListOfLogs.txt) .EXAMPLE Get-Content ListOfLogs.txt | Set-WinEvtLog -Enable .PARAMETER Log The log(s) to modIfy. .PARAMETER Enable Enables the log(s). .PARAMETER Disable Disables the log(s). #> [CmdletBinding(SupportsShouldProcess=$True,ConfirmImpact='Low')] param ( [Parameter(Mandatory=$True, ValueFromPipeline=$False, ValueFromPipelineByPropertyName=$True, HelpMessage='Which log do you want to enable?')] [string[]]$Log, [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True, ParameterSetName = 'Enable')] [Switch]$Enable, [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True, ParameterSetName = 'Disable')] [Switch]$Disable ) Begin { # Keep track of changes made to event logs in a separate file. $RecordLog = "${RecordKeepingDir}\WinEvtLogs-Enabled.log" If ( !(Test-Path -Path $RecordLog) ) { # Create the record keeping log file If it doesn't exist. $NewFile = ((New-Item -Path $RecordLog -ItemType file).name | Out-String) $NewFile = $NewFile.Trim() Write-Verbose "$NewFile did not exist and has been created." } } Process { # Make sure Record Keeping is properly configured, otherwise exit. If ( !($RecordLog) ) { Write-Verbose "The record keeping log does not exist, this function will not continue." Return } # Loop through the name(s) in the $Log variable passed to this function. ForEach ($name in $Log) { # Process the data only If the script should Process data. If ( $pscmdlet.ShouldProcess($name, 'Enable Log') ) { # Load the RecordLog into a variable. $PreviouslyEnabledLogs = Get-Content $RecordLog # Determine whether to Enable or Disable logging of the specIfied log. Switch ($PSCmdlet.ParameterSetName) { 'Enable' { $SetEnable = $True } 'Disable' { $SetEnable = $False } } # Create a new object for the specIfied log. $LogObject = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $name # Set the variable to determine whether the log has been enabled by this script or not $IsEnabledByFunction = $False # Determine whether or not the log had been enabled by this function. ForEach ($item in $PreviouslyEnabledLogs) { If ($item -eq $name) { $IsEnabledByFunction = $True } } # Act based on whether the log is already enabled or not. Switch ($logObject.IsEnabled) { $True { # Inform user whether this log has been enabled by this function or not. If ($IsEnabledByFunction) { Write-Verbose "$name has previously been enabled by this function." } Else { Write-Verbose "$name has previously been enabled, but not by this function." } } $False { # Inform user that this log has been disabled by something other than this function. If ($IsEnabledByFunction) { Write-Verbose "$name should already be enabled by this function, but has been disabled by other means." } } } # ModIfy the log to either enable or disable it. If ($LogObject.IsEnabled -eq $SetEnable) { Write-Verbose "$name is already in the desired state." } Else { # Set the log to the desired state. $LogObject.IsEnabled = $SetEnable # Save changes to the log. $LogObject.SaveChanges() # VerIfy the change has been made. Switch ($LogObject.IsEnabled) { $True { Write-Verbose "$name has been enabled." # Make sure this log wasn't already enabled by this function so we don't write the same name more than once in $RecordLog If (!($IsEnabledByFunction)) { Add-Content -Path $RecordLog "$name" } } $False { # Remove $name from $RecordLog If it was put there by this function. If ($IsEnabledByFunction) { # Clear the contents of $RecordLog Clear-Content -Path $RecordLog # Add each item back in that was already there except for the current $name ForEach ($filename In $PreviouslyEnabledLogs) { If ($filename -ne $name) { Add-Content -Path $RecordLog $filename} } } Write-Verbose "$name has been disabled." } } } } } } end {} } Export-ModuleMember -Function Set-WinEvtLog