Windows Events with Powershell

Below is a one-liner for getting a list of computers from your domain controller that have fallen off the domain in the last 24 hours. Using my google-foo, I was unable to find a good enough example to make this happen. So here is how I did it. You can change the LogName to any log associated with Event Viewer along with the InstanceID.

Get-EventLog -computername "Your Domain Controller Name" -LogName System -InstanceId 5723,5722,5805 -After (GET-Date).AddDays(-1) |Select-Object  ReplacementStrings -unique| foreach-object{$_.ReplacementStrings.Split(",")| select-object -First 1} | Sort-Object -Unique

If you are unsure as to which portion of data you need from the event logs then try the below command to find out what your options are. fl, short for Format-List, will list all your properties when followed by “-property *”

Get-EventLog -computername "Your Computer Name" -LogName Application -InstanceId 5973 -After (GET-Date).AddDays(-1) | fl -Property *

EventID : 5973
MachineName : Computer.YourDomain.Com
Data : {}
Index : 283088
Category : (5973)
CategoryNumber : 5973
EntryType : Error
Message : Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Source : Microsoft-Windows-Immersive-Shell
ReplacementStrings : {Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI, -2144927149}
InstanceId : 5973
TimeGenerated : 7/13/2020 3:06:05 PM
TimeWritten : 7/13/2020 3:06:05 PM
UserName : Domain\user