SHARE
TWEET

Backup Windows Event Logs

johndoe8 Oct 22nd, 2015 73 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ## Will RunAs Administrator if not already elevated - needed for the Security Event Log
  2. If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {  
  3. $arguments = "& '" + $myinvocation.mycommand.definition + "'"
  4. Start-Process powershell -Verb runAs -ArgumentList $arguments
  5. Break
  6. }
  7.  
  8. $date = (get-date -uformat %Y%m%d) + "_" + (get-date -uformat %H%M)
  9. $backuploc = $env:USERPROFILE + '\Documents\EventLogBkps'
  10. $CurrentEventLogs = Get-EventLog -List | select Log
  11. $EventLogList = 'Application','Security','System','Some Custom Log Name'
  12.  
  13. if (!(Test-Path $backuploc)) { md $backuploc | Out-Null}
  14.  
  15. foreach ($logitem in $EventLogList) {
  16.     if ($CurrentEventLogs.Log -contains $logitem) {  
  17.         wevtutil epl $logitem "$backuploc\$($logitem)_eventlog_($date).evtx"
  18.         $file = Get-ChildItem "$backuploc\$($logitem)_eventlog_($date).evtx"
  19.         Write-Host 'Created: ' -ForegroundColor Green -NoNewline
  20.         Write-Host '$backuploc\$($logitem)_eventlog_($date).evtx' -NoNewline -ForegroundColor White
  21.         Write-Host ' File size: ' -NoNewline -ForegroundColor Yellow
  22.         Write-Host $file.length -ForegroundColor White
  23.     }
  24. }
  25.  
  26. Write-Host ""
  27.  
  28. $title = "Clear Logs"
  29. $message = "Do you want to clear all of the primary Event Logs?"
  30. $yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes", "Clears event entries in each Event Log."
  31. $no = New-Object System.Management.Automation.Host.ChoiceDescription "&No", "Doesn't clear any entries from Event Logs."
  32. $options = [System.Management.Automation.Host.ChoiceDescription[]]($yes, $no)
  33. $result = $host.ui.PromptForChoice($title, $message, $options, 0)
  34. switch ($result)
  35.     {
  36.         0 {
  37.             Write-Host ""
  38.             foreach ($logtoclear in $EventLogList) {
  39.                 if ($CurrentEventLogs.Log -contains $logtoclear) {
  40.                     clear-eventlog -log $logtoclear
  41.                     Write-Host "$logtoclear" -ForegroundColor Green -NoNewline
  42.                     Write-Host " has been cleared." -ForegroundColor White
  43.                 }
  44.             }
  45.         }
  46.     }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top