Mastering Active Directory

Reviewing events with PowerShell

We also can use PowerShell commands to review event logs or filter events from local and remote computers without any additional service configurations. Get-EventLog is the primary cmdlet we can use for this task:

Get-EventLog -List

The previous command will list down the details about the log files in your local system, including the log file name, max log file size, and number of entries:

Get-EventLog -LogName 'Directory Service' | fl

The previous command will list down all the events under the log file Directory Service. We also can limit the number of events we need to list down. As an example, if we only need to list down the latest 5 events from the Directory Service log file, we can use:

Get-EventLog ...