locked
Event 1644 reader: Export LDAP search event 1644 from AD evtx to xlsx. Script giving Excel COM error. RRS feed

  • General discussion

  • I'm trying to run the script named "Event 1644 reader: Export LDAP search event 1644 from AD evtx to xlsx." located here: TechNet ScriptCentre

    When I run the script on my exported EVTX files, I keep getting this error:

    Event1644Reader: See https://support.microsoft.com/en-us/kb/3060643 for sample walk through and pivotTable tips.
    Enter local, mapped or UNC path to Evtx(s). Be sure to remove trailing blank. For Example (c:\CaseData)
     Or press [Enter] if evtx is in the script folder.
    :
        Scanning event logs in C:\Users\MyUserName\Documents\TEMP\DSLOGS
    Reading  DS001_AD01.evtx
        Event 1644 found, generating C:\Users\MyUserName\Documents\TEMP\DSLOGS\1644-DS001_AD01.csv
    Import csv to excel.
    Customizing XLS.
    Error HRESULT E_FAIL has been returned from a call to a COM component.
    At C:\Users\MyUserName\Documents\TEMP\DSLOGS\Event 1644 Reader.ps1:101 char:5
    +     $mcExcel.CommandBars.ExecuteMso("SortDescendingExcel")
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OperationStopped: (:) [], COMException
        + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
    
    Error HRESULT E_FAIL has been returned from a call to a COM component.
    At C:\Users\MyUserName\Documents\TEMP\DSLOGS\Event 1644 Reader.ps1:101 char:5
    +     $mcExcel.CommandBars.ExecuteMso("SortDescendingExcel")
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OperationStopped: (:) [], COMException
        + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
    
    Error HRESULT E_FAIL has been returned from a call to a COM component.
    At C:\Users\MyUserName\Documents\TEMP\DSLOGS\Event 1644 Reader.ps1:101 char:5
    +     $mcExcel.CommandBars.ExecuteMso("SortDescendingExcel")
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OperationStopped: (:) [], COMException
        + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
    
    Error HRESULT E_FAIL has been returned from a call to a COM component.
    At C:\Users\MyUserName\Documents\TEMP\DSLOGS\Event 1644 Reader.ps1:101 char:5
    +     $mcExcel.CommandBars.ExecuteMso("SortDescendingExcel")
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OperationStopped: (:) [], COMException
        + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
    
    Error HRESULT E_FAIL has been returned from a call to a COM component.
    At C:\Users\MyUserName\Documents\TEMP\DSLOGS\Event 1644 Reader.ps1:101 char:5
    +     $mcExcel.CommandBars.ExecuteMso("SortDescendingExcel")
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OperationStopped: (:) [], COMException
        + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException
    
    Enter a FileName to save extracted event 1644 xlsx.
    : Test
    Saving file to C:\Users\MyUserName\Documents\TEMP\DSLOGS\Test.xlsx
    Delete generated 1644-*.csv? ([Enter]/[Y] to delete, [N] to keep csv)
    : n
    Script completed.
    PS C:\Users\MyUserName\Documents\TEMP\DSLOGS>
    

    The error happens on this line of code:

    Function mcSortPivotFields($mcPF) 
    { #Sort on $mcPF and collapse later pivot fields 
        for ($i=2; $i -lt 5; $i++) { #collapse later pivot fields 
            if ($mcPF[$i] -ne $null) { $mcPF[$i].showDetail = $false } 
        } 
    #    [void]($mcPF[0].Cells.Item(4,2)).sort(($mcPF[0].Cells.Item(4, 2)), 2) 
    #    $mcPF[1].showDetail = $false 
        $mcPF[0].Cells(4,2).Select() | Out-Null 
        $mcExcel.CommandBars.ExecuteMso("SortDescendingExcel") 
    # ERROR HAPPENS HERE ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    I've run the code in an elevated script, non-elevated script and in the PowerShell ISE and keep getting the same error but I cannot figger out why?

    I'm using MS Office 365 ProPlus V1708 on Windows 7 Enterprise x64.

    • Changed type Bill_Stewart Wednesday, November 29, 2017 11:49 PM
    • Moved by Bill_Stewart Wednesday, November 29, 2017 11:50 PM This is not a support forum for gallery scripts
    Monday, October 23, 2017 8:57 AM

All replies

  • We didn't write that script, so you will need to ask the author.

    -- Bill Stewart [Bill_Stewart]

    Monday, October 23, 2017 4:02 PM
  • Thanks Bill, but I could not find a way to contact the author and the page says to come here for support.

    From what I can gather, it seems that since I'm using Excel365 then it must be a reference issue where the script is trying to access the Excel 2013 command bars which don't exist on my workstation.

    Monday, October 23, 2017 9:45 PM
  • Sorry, but this is not a support forum for gallery scripts. (This is a peer-to-peer scripting questions forum with no SLA.) Unfortunately since that gallery entry does not have Q&A enabled for it, you will need to find the author and ask him directly, troubleshoot it on your own, or hire a consultant to assist.


    -- Bill Stewart [Bill_Stewart]

    Monday, October 23, 2017 9:48 PM
  • Thanks Bill, but I could not find a way to contact the author and the page says to come here for support.

    From what I can gather, it seems that since I'm using Excel365 then it must be a reference issue where the script is trying to access the Excel 2013 command bars which don't exist on my workstation.


    I use Excel 2016 fro O365.  The command for the sort is there and works.  Perhaps your installation is damaged.

    \_(ツ)_/

    Monday, October 23, 2017 9:50 PM
  • The author is a Microsoft employee and has only ever posted to items since 2007.

    You will have to learn PowerShell and Windows then do some debugging.


    \_(ツ)_/

    Monday, October 23, 2017 9:54 PM