Score:0

Server

PowerShell: Why am I getting this error?

Tony Chong

2/5/23, 10:35 PM

I am trying to use the PowerShell Invoke command. I am using it correct but I don't know why I am getting an error.

Invoke-Command Get-EventLog –LogName Security –Newest 100 -ComputerName WIN-9F8JQL0989

The error message:

109

0 + 0

scripting

powershell

Score:2

Server

Mike Shepard

2/5/23, 11:14 PM

I'm guessing you want to get the newest 100 security event logs from the named computer.

To do that, you just missed some braces:

Invoke-Command { Get-EventLog –LogName Security –Newest 100} -ComputerName WIN-9F8JQL0989

The braces denote the scriptblock/payload that you want to execute (the command).

The error you were getting was because you had mixed the command-lines for invoke-command and get-eventlog, so the parser couldn't figure out which parameters belonged where. It thought the -LogName (and -Newest for that matter) was being used with invoke-command, and it doesn't have that parameter.

0 + 0

Tony Chong

2/5/23, 11:51 PM

Not it says access is denied.

Mike Shepard

2/6/23, 1:26 AM

Then your current creds probably don't have access.

Tony Chong

2/6/23, 1:48 AM

I am logged in as an administrator. Is there anything else I can do?

Mike Shepard

2/6/23, 2:11 AM

You can try passing the credentials explicitly with -Credential

Mike Shepard

2/6/23, 2:12 AM

Here's a link to a page on PowerShell remoting security. There are lots of things that can be going on now...https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-5.1

TessellatingHeckler

2/6/23, 5:10 AM

"*I am logged in as an administrator. Is there anything else I can do?*" - did you also right-click "Run as administrator" on PowerShell, so it says "Administrator: Windows PowerShell" in the title, @TonyChong

Score:0

Server

Tony Chong

2/6/23, 10:47 PM

Ok, so the answer to my question was that I had to pass the credentials explicitly by using the Credential parameter AND create a new PSSession with the same command. This is because PowerShell has too much attitude.

Invoke-Command -Session (NewPSSession WIN-9F8JQL85GIA -Credential AD\Administrator) -ScriptBlock {Get-EventLog -LogName Security -Newest 100}

That is the correct answer.