powershell - 在 Powershell 中使用 Get-EventLog 远程读取事件日志

Question

我有一个 powershell 脚本，它在服务器(测试服务器)上运行并读取他的客户端(DC1)的日志文件。

双方可以互相ping通。

在双方，防火墙都被禁用。

DC1 上启用了远程桌面和远程协助。

Get-EventLog System -ComputerName test-server -Source Microsoft-Windows-Winlogon # WORKS
Get-EventLog System -ComputerName DC1 -Source Microsoft-Windows-Winlogon # DOESN'T WORK

我在测试服务器上运行这个脚本。如您所见，当我在测试服务器上读取本地日志文件时，它工作正常，但如果我尝试远程读取 DC1 的日志文件，我会收到错误“Get-EventLog:找不到网络路径。”。

错误截图:


如何避免此错误并使用 Get-EventLog 从测试服务器读取 DC1 的日志文件？

Answer 1

开始 远程注册 服务对我没有帮助。
显然，在某些 cmdlet(如 Get-Service)中通过 ComputerName 参数访问的远程处理与通过 Invoke-Command 等 cmdlet 访问的较新形式的远程处理之间存在差异。

Since traditional remote access is implemented by individual cmdlets,it is inconsistent (uses different techniques and demands differentrequirements) and available only in selected cmdlets. The technologyused for remote access can vary from cmdlet to cmdlet and is notreadily known to you. Each cmdlet uses whatever remoting technologyits author chose. Most cmdlets use Remote Procedure Call (RPC), butmight also require additional services and settings on the targetsystem.

Beginning in Windows PowerShell 2.0, there is an alternate and moreuniversal way of accessing remote systems: Windows PowerShellRemoting. With this type of remoting, Windows PowerShell handlesremote access for all commands. It transfers your commands to theremote system using the relatively new and highly configurable WinRMservice, executes the code in a separate session that runs on theremote system, and returns the results to the calling system.

http://powershell.com/cs/media/p/7257.aspx

当我从这个命令交换

get-eventlog -LogName System -computername <ServerName>

对此

invoke-command {get-eventlog -LogName System} -ComputerName <ServerName>

我不再收到以下错误

get-eventlog : The network path was not found.