Skip to content

Instantly share code, notes, and snippets.

@joswr1ght

joswr1ght/Copy-RemoteWindowsEventLogs.ps1

Last active October 22, 2025 14:18
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save joswr1ght/d8e9c63b8a1c4df84b6dfcb3c227a5df to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save joswr1ght/d8e9c63b8a1c4df84b6dfcb3c227a5df to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. joswr1ght revised this gist May 31, 2023. 1 changed file with 4 additions and 8 deletions.
    12 changes: 4 additions & 8 deletions Copy-RemoteWindowsEventLogs.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -13,16 +13,12 @@ $hostnames = Get-Content $inputFile

    foreach ($hostname in $hostnames) {

    # Create directory for this hostname if it doesn't exist
    $directoryPath = ".\$hostname"
    if(!(Test-Path -Path $directoryPath )) {
    New-Item -ItemType directory -Path $directoryPath
    }
    Write-Host "Copying event logs files from $hostname"

    # Source path where event logs are located in the remote system
    $sourcePath = "\\$hostname\C$\Windows\System32\winevt\Logs\"
    # Create directory for this hostname
    New-Item -ItemType directory -Path ".\Logs\$hostname" -ErrorAction SilentlyContinue | Out-Null

    # Copy log files from remote host to local directory
    Copy-Item -Path $sourcePath -Destination $directoryPath -Recurse -Force
    Copy-Item -Path "\\$hostname\C$\Windows\System32\winevt\Logs\" -Destination ".\Logs\$hostname" -Recurse -Force | Out-Null

    }
  2. joswr1ght revised this gist May 30, 2023. 1 changed file with 2 additions and 6 deletions.
    8 changes: 2 additions & 6 deletions Copy-RemoteWindowsEventLogs.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -12,8 +12,6 @@ param (
    $hostnames = Get-Content $inputFile

    foreach ($hostname in $hostnames) {
    # Establish a remote session
    $session = New-PSSession -ComputerName $hostname -Credential $Credential

    # Create directory for this hostname if it doesn't exist
    $directoryPath = ".\$hostname"
    @@ -26,7 +24,5 @@ foreach ($hostname in $hostnames) {

    # Copy log files from remote host to local directory
    Copy-Item -Path $sourcePath -Destination $directoryPath -Recurse -Force

    # Remove the remote session
    Remove-PSSession $session
    }

    }
  3. joswr1ght created this gist May 29, 2023.
    32 changes: 32 additions & 0 deletions Copy-RemoteWindowsEventLogs.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,32 @@
    # https://chat.openai.com/share/6d96527b-288d-45a9-8eb4-e8b43d52486a
    # Input parameters
    param (
    [Parameter(Mandatory=$true)]
    [string]$inputFile,

    [Parameter(Mandatory=$true)]
    [System.Management.Automation.PSCredential]$Credential
    )

    # Read hostnames from input file
    $hostnames = Get-Content $inputFile

    foreach ($hostname in $hostnames) {
    # Establish a remote session
    $session = New-PSSession -ComputerName $hostname -Credential $Credential

    # Create directory for this hostname if it doesn't exist
    $directoryPath = ".\$hostname"
    if(!(Test-Path -Path $directoryPath )) {
    New-Item -ItemType directory -Path $directoryPath
    }

    # Source path where event logs are located in the remote system
    $sourcePath = "\\$hostname\C$\Windows\System32\winevt\Logs\"

    # Copy log files from remote host to local directory
    Copy-Item -Path $sourcePath -Destination $directoryPath -Recurse -Force

    # Remove the remote session
    Remove-PSSession $session
    }