For what it's worth, this is the script I use to find Windows Error Reports that have not been sent, and delete archived Windows Error Reports:
It's not currently doing per-user error reports, as we don't have people logging into the servers, typically.
Karl
<#
.SYNOPSIS
Find-WER - Finds Windows Error Reports that have not been sent to Microsoft.
.DESCRIPTION
This script finds Windows Error Reports that have not been sent to Microsoft.
This script also deletes archived Windows Error Reports.
.NOTES
File Name: Find-WER.ps1
Author: Karl Mitschke
Requires: Powershell V2
Created: 12/16/2011
.EXAMPLE
C:\PS>.\Find-Wer.ps1
Description
-----------
Finds Windows Error Reports on the local computer.
.EXAMPLE
C:\PS>.\Find-WER -Computer Exch2010
Description
-----------
Finds Windows Error Reports on the computer Exch2010.
.EXAMPLE
C:\PS> Get-ExchangeServer | Find-WER
Description
-----------
Finds Windows Error Reports on all Exchange servers.
.EXAMPLE
C:\PS> $cred = Get-Credential -Credential mitschke\karlm
C:\PS>.\Find-WER.ps1 -ComputerName (Get-Content -Path ..\Servers.txt) -Credential $cred
Description
-----------
Finds Windows Error Reports on all servers in the file Servers.txt.
.PARAMETER ComputerName
The Computer(s) to search for Windows Error Reports. If not specified, defaults to the local computer.
.PARAMETER Credential
The Credential to use. If not specified, runs under the current security context.
#>
[CmdletBinding(SupportsShouldProcess=$true, ConfirmImpact='Medium')]
param (
[parameter(
Position = 1,
Mandatory=$false,
ValueFromPipeline=$true)
]
[String[]]$ComputerName=$Env:ComputerName,
[Parameter(
Position = 2,
Mandatory = $false,
ValueFromPipeline=$false)
]
$Credential
)
BEGIN{
#region PSBoundParameters modification
if ($Credential -ne $null -and $Credential.GetType().Name -eq "String"){
$PSBoundParameters.Remove("Credential") | Out-Null
$PSBoundParameters.Add("Credential", (Get-Credential -Credential $Credential))
}
$PSBoundParameters.Remove("WhatIf") | Out-Null
#endregion
$ReportPath = "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue"
$ArchivePath = "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive"
$FoundReport = $false
$DeleteFailure = $false
}
PROCESS {
$PSBoundParameters.Remove("ComputerName") | Out-Null
foreach ($StrComputer in $ComputerName){
$Count = @((Get-WmiObject Win32_Directory -Filter "Name= '$ReportPath'" -ComputerName $StrComputer @PSBoundParameters).GetRelated('Win32_directory') |? {$_.name -match $ReportPath}).Count
if ($Count -gt 0){
Write-Warning "There are $Count Windows Error Reports on $StrComputer."
$FoundReport = $true
}
Else{
Write-Output "There are no Windows Error Reports on $StrComputer."
}
$Archives = @((Get-WmiObject Win32_Directory -Filter "Name= '$ArchivePath'" -ComputerName $StrComputer @PSBoundParameters).GetRelated('Win32_directory') |? {$_.name -match $ArchivePath})
if ($Archives.Count -gt 0){
Write-Output "Deleting Archived Windows Error Reports on $StrComputer."
foreach ($Folder in $Archives)
{
if ($pscmdlet.ShouldProcess($($StrComputer), "Deleting '$($folder.name.split("\")[-1])'")){
$Return = $Folder.Delete()
if ($Return.ReturnValue -ne 0){
$DeleteFailure = $true
}
}
}
if ($DeleteFailure -eq $true){
Write-Warning "Could not delete all Archived Windows Error Reports on $StrComputer."
}
}
}
}
END {
If ($FoundReport){
Write-Warning "Remember to run the Action items on the servers."
}
else{
Write-Output "There are no Windows Error Reports."
}
}
When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer.
My Blog: Unlock PowerShell
My Book:
Windows PowerShell 2.0 Bible
My E-mail: -join ('6F6C646B61726C406F75746C6F6F6B2E636F6D'-split'(?<=\G.{2})'|%{if($_){[char][int]"0x$_"}})
