RIP Get-EventLog
Nov. 15th, 2025 07:37 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
mellowtiggerToday at work, I wanted/needed a faster way to collect particular events in the Microsoft Windows event logs. I had the obvious way to collect them from the gui, but I needed something better. I decided to try powershell.
Click to read the powershell code and follow the small adventure...
I had no idea beforehand that the log source name in the gui is different from the one accessed by powershell. It took some googling to figure out the right mix of parameters and clauses, but it worked. Sort of. Here's the code I came up with:
Get-EventLog -LogName System -Source Microsoft-Windows-Kernel-General -After (Get-Date).AddDays(-10) | Where-Object { $_.EventID -eq 1 -and $_.CategoryNumber -eq 5 } | Out-GridView
It definitely found the appropriate events from the log. It did not, however, provide the appropriate message about the reason for the log entry. Instead of the rational reason that the gui showed me, this script was telling me:
Possible detection of CVE: 2025-11-15T20:31:07.5402125Z This Event is generated when an attempt to exploit a known vulnerability (2025-11-15T20:31:07.5402125Z) is detected.
Whoa. That sounds bad/dangerous. After digging into other properties of the software object I was given, I finally noticed the purple note in the official Microsoft documentation that this command has been deprecated! Argh! I was probably getting CVE-similarity notices because I was still using this deprecated 32-bit command.
I switched to the new powershell command, and it again took me a while and several consultations with Google to hammer out the new (and actually better) command:
Get-WinEvent -FilterHashTable @{ProviderName='Microsoft-Windows-Kernel-General'; Id=1; StartTime = (Get-Date).AddDays(-10)} | Where-Object { $_.Message -match 'Change Reason:.*time zone.*' } | Select-Object TimeCreated, Message | Out-GridView
Note to self: In order to get the html <pre> text formatted correctly in this post, so long text wraps to a new line, I had to create the tags like this:
<pre style="white-space: pre-wrap;"</pre>
Finally! This new powershell command shows the correct reason for the log entry and the directory path to the program that produced it. That's exactly what I needed. Yay, although I'm clearly out of practice with powershell. After collecting data, I opened a ticket to have our next tier of IT take a look at my computer and find why this particular event keeps showing up. Something is changing my timezone (to the wrong timezone) throughout the day, even after I manually change it back to the correct timezone.
