management-scripts/PSModule/old/PSModule-SetWinEvtLog.psm1

Function global:Set-WinEvtLog {
    <#
    .SYNOPSIS
    Enable/Disable an event log.
    .DESCRIPTION
    Enable or disable a Windows Event Log using the System.Diagnostics.Eventing.Reader.EventLogConfiguration object.
    This function only outputs terminating errors to the console. If you want to see more detail use -verbose
    .EXAMPLE
    Set-WinEvtLog -Enable -Log "Microsoft-Windows-DNS-Client/Operational"
    .EXAMPLE
    Set-WinEvtLog -Disable -Log (Get-Content ListOfLogs.txt)
    .EXAMPLE
    Get-Content ListOfLogs.txt | Set-WinEvtLog -Enable
    .PARAMETER Log
    The log(s) to modIfy.
    .PARAMETER Enable
    Enables the log(s).
    .PARAMETER Disable
    Disables the log(s).
    #>
    
    [CmdletBinding(SupportsShouldProcess=$True,ConfirmImpact='Low')]
    param
    (
        [Parameter(Mandatory=$True,
            ValueFromPipeline=$False,
            ValueFromPipelineByPropertyName=$True,
            HelpMessage='Which log do you want to enable?')]
            [string[]]$Log,
        [Parameter(Mandatory=$True,
            ValueFromPipelineByPropertyName=$True,
            ParameterSetName = 'Enable')]
            [Switch]$Enable,
        [Parameter(Mandatory=$True,
            ValueFromPipelineByPropertyName=$True,
            ParameterSetName = 'Disable')]
            [Switch]$Disable
    )
    
    Begin
    {
        # Keep track of changes made to event logs in a separate file.
        $RecordLog = "${Env:MSPDir}\Logs\WinEvtLogs-Enabled.log"
        
        If ( !(Test-Path -Path $RecordLog) )
        {
            # Create the record keeping log file If it doesn't exist.
            $NewFile = ((New-Item -Path $RecordLog -ItemType file).name | Out-String)
            $NewFile = $NewFile.Trim()
            Write-Verbose "$NewFile did not exist and has been created."
        }
    }
    
    Process
    {
        # Make sure Record Keeping is properly configured, otherwise exit.
        If ( !($RecordLog) )
        {
          Write-Verbose "The record keeping log does not exist, this function will not continue."
          Return
        }
        
        # Loop through the name(s) in the $Log variable passed to this function.
        ForEach ($name in $Log)
        {
            # Process the data only If the script should Process data.
            If ( $pscmdlet.ShouldProcess($name, 'Enable Log') )
            {
                # Load the RecordLog into a variable.
                $PreviouslyEnabledLogs = Get-Content $RecordLog
                
                # Determine whether to Enable or Disable logging of the specIfied log.
                Switch ($PSCmdlet.ParameterSetName)
                {
                    'Enable' { $SetEnable = $True }
                    'Disable' { $SetEnable = $False }
                }
                
                # Create a new object for the specIfied log.
                $LogObject = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $name
                
                # Set the variable to determine whether the log has been enabled by this script or not
                $IsEnabledByFunction = $False
                
                # Determine whether or not the log had been enabled by this function.
                ForEach ($item in $PreviouslyEnabledLogs)
                { If ($item -eq $name) { $IsEnabledByFunction = $True } }
                
                # Act based on whether the log is already enabled or not.
                Switch ($logObject.IsEnabled)
                {
                    $True
                    {
                      # Inform user whether this log has been enabled by this function or not.
                      If ($IsEnabledByFunction)
                      { Write-Verbose "$name has previously been enabled by this function." }
                      Else { Write-Verbose "$name has previously been enabled, but not by this function." }
                    }
                    
                    $False
                    {
                      # Inform user that this log has been disabled by something other than this function.
                      If ($IsEnabledByFunction)
                      { Write-Verbose "$name should already be enabled by this function, but has been disabled by other means." }
                    }
                }
                
                # ModIfy the log to either enable or disable it.
                If ($LogObject.IsEnabled -eq $SetEnable)
                { Write-Verbose "$name is already in the desired state." }
                Else
                {
                    # Set the log to the desired state.
                    $LogObject.IsEnabled = $SetEnable
                    
                    # Save changes to the log.
                    $LogObject.SaveChanges()
                    
                    # VerIfy the change has been made.
                    Switch ($LogObject.IsEnabled)
                    {
                        $True
                        {
                            Write-Verbose "$name has been enabled."
                            
                            # Make sure this log wasn't already enabled by this function so we don't write the same name more than once in $RecordLog
                            If (!($IsEnabledByFunction)) { Add-Content -Path $RecordLog "$name" }
                        }
                        
                        $False
                        {
                            # Remove $name from $RecordLog If it was put there by this function.
                            If ($IsEnabledByFunction)
                            {
                                # Clear the contents of $RecordLog
                                Clear-Content -Path $RecordLog
                                
                                # Add each item back in that was already there except for the current $name
                                ForEach ($filename In $PreviouslyEnabledLogs)
                                { If ($filename -ne $name) { Add-Content -Path $RecordLog $filename} }
                            }
                            Write-Verbose "$name has been disabled."
                        }
                    }
                }
            }
        }
    }
    
    end {}
}
Export-ModuleMember -Function Set-WinEvtLog