Task Scheduler - get history information into script variables

前端 未结 1 1733
悲&欢浪女
悲&欢浪女 2020-12-16 19:36

Is there a way of getting the task scheduler history information into an array or variable inside a batch or PowerShell script.

For example, get the information such

相关标签:
1条回答
  • 2020-12-16 20:08

    The Task Scheduler logs to the following event channel:
    Microsoft-Windows-TaskScheduler/Operational

    You can use Get-WinEvent to gather the events. Start out by defining a filter hash table for the id 100 start events

    # Event filter for the initial query for all "Start" events in the last 24 hours
    $EventFilter = @{
        LogName = 'Microsoft-Windows-TaskScheduler/Operational'
        Id = 100
        StartTime = [datetime]::Now.AddDays(-1)
    }
    

    We're gonna need to extract some property values from the start event, in order to find the correlated completion event, so let's create a Property Selector

    # PropertySelector for the Correlation id (the InstanceId) and task name
    [string[]]$PropertyQueries = @(
        'Event/EventData/Data[@Name="InstanceId"]'
        'Event/EventData/Data[@Name="TaskName"]'
    )
    $PropertySelector = New-Object System.Diagnostics.Eventing.Reader.EventLogPropertySelector @(,$PropertyQueries)
    

    Now retrieve the start events, find the corresponding completion event, and output the information as a new custom object:

    # Loop through the start events
    $TaskInvocations = foreach($StartEvent in Get-WinEvent -FilterHashtable $EventFilter){
        # Grab the InstanceId and Task Name from the start event
        $InstanceId,$TaskName = $StartEvent.GetPropertyValues($PropertySelector)
    
        # Create custom object with the name and start event, query end event by InstanceId
        [pscustomobject]@{
            TaskName = $TaskName
            StartTime = $StartEvent.TimeCreated
            EndTime = $(Get-WinEvent -FilterXPath "*[System[(EventID=102)] and EventData[Data[@Name=""InstanceId""] and Data=""{$InstanceId}""]]" -LogName 'Microsoft-Windows-TaskScheduler/Operational' -ErrorAction SilentlyContinue).TimeCreated
        }
    }
    

    You can populate a DataTable with the objects in $TaskInvocations, or generate an insert query based on the property values

    0 讨论(0)
提交回复
热议问题