Custom Viewconfig

function writeFile([string] $path, [string] $name){
    If(!(test-path $path))
    {
        New-Item -ItemType Directory -Force -Path $path | Out-Null
    }
    $fileCount=@(Get-ChildItem $path -File).Count
'<ViewerConfig>
  <Name>'+$name+'</Name>
  <ResultsConfig>
    <Columns>
      <Column Name="Ebene" Type="System.String" Path="Event/System/Level" Visible="">140</Column>
      <Column Name="Schlüsselwörter" Type="System.String" Path="Event/System/Keywords">200</Column>
      <Column Name="Datum und Uhrzeit" Type="System.DateTime" Path="Event/System/TimeCreated/@SystemTime" Visible="">145</Column>
      <Column Name="Quelle" Type="System.String" Path="Event/System/Provider/@Name" Visible="">550</Column>
      <Column Name="Ereignis-ID" Type="System.UInt32" Path="Event/System/EventID" Visible="">200</Column>
      <Column Name="Aufgabenkategorie" Type="System.String" Path="Event/System/Task" Visible="">250</Column>
      <Column Name="Benutzer" Type="System.String" Path="Event/System/Security/@UserID">50</Column>
      <Column Name="Vorgangscode" Type="System.String" Path="Event/System/Opcode">110</Column>
      <Column Name="Protokoll" Type="System.String" Path="Event/System/Channel">100</Column>
      <Column Name="Computer" Type="System.String" Path="Event/System/Computer" Visible="">170</Column>
      <Column Name="Prozess-ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessID">70</Column>
      <Column Name="Thread-ID" Type="System.UInt32" Path="Event/System/Execution/@ThreadID">70</Column>
      <Column Name="Prozessor-ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessorID">90</Column>
      <Column Name="Sitzungs-ID" Type="System.UInt32" Path="Event/System/Execution/@SessionID">70</Column>
      <Column Name="Kernel-Zeit" Type="System.UInt32" Path="Event/System/Execution/@KernelTime">80</Column>
      <Column Name="Benutzerzeit" Type="System.UInt32" Path="Event/System/Execution/@UserTime">70</Column>
      <Column Name="Prozessor-Zeit" Type="System.UInt32" Path="Event/System/Execution/@ProcessorTime">100</Column>
      <Column Name="Korrelations-ID" Type="System.Guid" Path="Event/System/Correlation/@ActivityID">85</Column>
      <Column Name="Relative Korrelations-ID" Type="System.Guid" Path="Event/System/Correlation/@RelatedActivityID">140</Column>
      <Column Name="Ereignisquellname" Type="System.String" Path="Event/System/Provider/@EventSourceName">140</Column>
    </Columns>
  </ResultsConfig>
</ViewerConfig>' | Out-File "$path\Channel_$fileCount.xml"
}
function localize($text){
$localeTable = @{
        "Operational" = "Betriebsbereit"
        "HardwareEvents" = "Hardware-Ereignisse"
        "Security" = "Sicherheit"
        "Application" = "Anwendung"
        "Key Management Service" = "Schlüsselverwaltungsdienst"
        "ForwardedEvents" = "Weitergeleitete Ereignisse"
        "Setup" = "Installation"
        "OAlerts" = "Microsoft Office Alerts"
        "Windows Networking Vpn Plugin Platform" = "Microsoft\Windows\Vpn Plugin Platform"
        "Microsoft\Windows\WDAG-PolicyEvaluator-CSP" = "CSP\Anbieter für WDAG\Richtlinienauswerter"
        "Microsoft\Windows\WDAG-PolicyEvaluator-GP" =  "GP\Anbieter für WDAG\Richtlinienauswerter"
        "Admin" = "Administrator"
}
    if($retVal=$localeTable[$text]){
        return $retVal
    }else{
        return $text
    }
}

$path = "$env:ProgramData\Microsoft\Event Viewer"
$windows = @("Application", "Security", "System", "ForwardedEvents", "Setup")
$builtin = $path+"\Windows-Protokolle"
$app = $path+"\Anwendungs- und Dienstprotokolle"

Remove-Item -Recurse -Force $app"\*"
Remove-Item -Recurse -Force $builtin"\*"

Get-WinEvent -ListLog * | % {
    if($windows.Contains($_.LogName)){
        writeFile $builtin (localize $_.LogName)
    }else{
        $components = $_.Logname.Split("/")
        if($components.Count -gt 1) {
            $name = $components[1]
            $components= $components[0].Split("-")
        }else{
            [System.Collections.ArrayList]$components= $components[0].Split("-")
            $name = $components[-1]
            $components.RemoveAt($components.Count-1)
        }
        if($components.Count -gt 2){
            $components = $components[0..1] +($components[2..($components.Count-1)] -join "-")
        }
        $path = localize ($components -join "\")
        WriteFile "$app\$path" (localize $name)
        #Operational ist manchmal übersetzt und manchmal nicht, deswegen beides schreiben
        if($name -eq "Operational" -or $name -eq "Admin"){
            writeFile "$app\$path" $name
        }
    }
}