none
wevtutil command gives no error, returns nothing. RRS feed

  • Question

  • Trying to get this latest event:

    "Remote Desktop Services: Session reconnection succeeded"
    EventID=24 

    ...using wevutil.exe

    But nothing gets returned. No error. What am I doing wrong?

    wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational "/q:*[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational [(EventID=24)]]" /f:text /rd:true /c:1



    • Edited by greatbear3021 Thursday, August 9, 2018 9:52 PM formatted for readability
    • Moved by Bill_Stewart Tuesday, December 11, 2018 11:27 PM Off-topic
    Thursday, August 9, 2018 9:51 PM

All replies

  • $filter = @{
        logname='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
        ID=24
    }
    Get-WinEvent -FilterHashtable $filter -MaxEvents 1 |select -expand Message


    \_(ツ)_/

    Thursday, August 9, 2018 10:11 PM
  •  wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /q:Event[System[EventID=24]] /f:text /rd:true /c:1


    \_(ツ)_/

    Thursday, August 9, 2018 10:22 PM
  • The Get-WinEvent equivalent is:

    Get-WinEvent -FilterXPath 'Event[System[EventID=24]]' -LogName Microsoft-Windows-TerminalServices-LocalSessionManager/Operational -MaxEvents 1

    For Clarity we can splat:

    $splatter = @{
        LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
        FilterXPath = 'Event[System[EventID=24]]'
        MaxEvents = 1
    }
    Get-WinEvent @splatter
    


    \_(ツ)_/

    Thursday, August 9, 2018 10:27 PM