Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
wevtutil command gives no error, returns nothing. RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote
    Trying to get this latest event:

    "Remote Desktop Services: Session reconnection succeeded"
    EventID=24 

    ...using wevutil.exe

    But nothing gets returned. No error. What am I doing wrong?

    wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational "/q:*[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational [(EventID=24)]]" /f:text /rd:true /c:1



    • Edited by greatbear3021 Thursday, August 9, 2018 9:52 PM formatted for readability
    • Moved by Bill_Stewart Tuesday, December 11, 2018 11:27 PM Off-topic
    Thursday, August 9, 2018 9:51 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote 
    $filter = @{
    logname='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
    ID=24
}
Get-WinEvent -FilterHashtable $filter -MaxEvents 1 |select -expand Message

    \_(ツ)_/

    Thursday, August 9, 2018 10:11 PM
  • Question
    Sign in to vote
    0
    Sign in to vote 
     wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /q:Event[System[EventID=24]] /f:text /rd:true /c:1

    \_(ツ)_/

    Thursday, August 9, 2018 10:22 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    The Get-WinEvent equivalent is:

    Get-WinEvent -FilterXPath 'Event[System[EventID=24]]' -LogName Microsoft-Windows-TerminalServices-LocalSessionManager/Operational -MaxEvents 1

    For Clarity we can splat:

    $splatter = @{
    LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
    FilterXPath = 'Event[System[EventID=24]]'
    MaxEvents = 1
}
Get-WinEvent @splatter

    \_(ツ)_/

    Thursday, August 9, 2018 10:27 PM