diff --git a/build/Seed.txt b/build/Seed.txt index 140ca43..cc5d9d1 100644 --- a/build/Seed.txt +++ b/build/Seed.txt @@ -1 +1 @@ -333376526 +1603595244 diff --git a/info/CHANGELOG.md b/info/CHANGELOG.md index dd6565f..56afd56 100644 --- a/info/CHANGELOG.md +++ b/info/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 2026-01-30 + +### Fixed + +- Replace Get-EventLog with Get-WinEvent to avoid unhandled errors generated by the former. + ## 2026-01-29 ### Added diff --git a/src/check/Credentials.ps1 b/src/check/Credentials.ps1 index cc88472..dd58f50 100644 --- a/src/check/Credentials.ps1 +++ b/src/check/Credentials.ps1 @@ -810,30 +810,25 @@ function Invoke-ScomRunAsAccountCredentialCheck { process { $AllResults = @() + $Accounts = @() + $OperationsManagerEventLogs = Get-WinEvent -LogName "Operations Manager" -ErrorAction SilentlyContinue - try { - $OperationsManagerEventLogs = Get-EventLog -LogName "Operations Manager" - $Accounts = @() - foreach ($OperationsManagerEventLog in $OperationsManagerEventLogs) { + foreach ($OperationsManagerEventLog in $OperationsManagerEventLogs) { - if ($OperationsManagerEventLog.Message -match ".*on the RunAs account (.+) for management group") { + if ($OperationsManagerEventLog.Message -match ".*on the RunAs account (.+) for management group") { - $AccountName = $Matches[1] - if ($Accounts -contains $AccountName) { continue } - $Accounts += $AccountName + $AccountName = $Matches[1] + if ($Accounts -contains $AccountName) { continue } + $Accounts += $AccountName - $Result = New-Object -TypeName PSObject - $Result | Add-Member -MemberType "NoteProperty" -Name "EventID" -Value $OperationsManagerEventLog.EventID - $Result | Add-Member -MemberType "NoteProperty" -Name "TimeGenerated" -Value $(Convert-DateToString -Date $OperationsManagerEventLog.TimeGenerated -IncludeTime) - $Result | Add-Member -MemberType "NoteProperty" -Name "Account" -Value $AccountName - $Result | Add-Member -MemberType "NoteProperty" -Name "Message" -Value $OperationsManagerEventLog.Message - $AllResults += $Result - } + $Result = New-Object -TypeName PSObject + $Result | Add-Member -MemberType "NoteProperty" -Name "Id" -Value $OperationsManagerEventLog.Id + $Result | Add-Member -MemberType "NoteProperty" -Name "TimeCreated" -Value $(Convert-DateToString -Date $OperationsManagerEventLog.TimeCreated -IncludeTime) + $Result | Add-Member -MemberType "NoteProperty" -Name "Account" -Value $AccountName + $Result | Add-Member -MemberType "NoteProperty" -Name "Message" -Value $OperationsManagerEventLog.Message + $AllResults += $Result } } - catch { - Write-Verbose "Event log 'Operations Manager' not found." - } $CheckResult = New-Object -TypeName PSObject $CheckResult | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $AllResults diff --git a/src/check/Misc.ps1 b/src/check/Misc.ps1 index 6966653..a18cd0f 100644 --- a/src/check/Misc.ps1 +++ b/src/check/Misc.ps1 @@ -110,40 +110,32 @@ function Invoke-SystemStartupHistoryCheck { [UInt32] $BaseSeverity ) - $Results = @() + process { + $Results = @() - try { $TimeSpanInDays = 31 - $SystemStartupHistoryResult = New-Object -TypeName System.Collections.ArrayList - + $SystemStartupHistoryResult = @() $StartDate = (Get-Date).AddDays(-$TimeSpanInDays) $EndDate = Get-Date - - $StartupEvents = Get-EventLog -LogName "System" -EntryType "Information" -After $StartDate -Before $EndDate | Where-Object { $_.EventID -eq 6005 } - + $StartupEvents = Get-WinEvent -LogName "System" -ErrorAction SilentlyContinue | Where-Object { ($_.Id -eq 6005) -and ($_.TimeCreated -ge $StartDate) -and ($_.TimeCreated -le $EndDate) } $EventNumber = 1 foreach ($StartupEvent in $StartupEvents) { $Result = New-Object -TypeName PSObject $Result | Add-Member -MemberType "NoteProperty" -Name "Index" -Value $EventNumber - $Result | Add-Member -MemberType "NoteProperty" -Name "Time" -Value "$(Convert-DateToString -Date $StartupEvent.TimeGenerated -IncludeTime)" - - [void] $SystemStartupHistoryResult.Add($Result) + $Result | Add-Member -MemberType "NoteProperty" -Name "Time" -Value "$(Convert-DateToString -Date $StartupEvent.TimeCreated -IncludeTime)" + $SystemStartupHistoryResult += $Result $EventNumber += 1 } $Results += $SystemStartupHistoryResult | Select-Object -First 10 - } - catch { - # We might get an "access denied" - Write-Verbose "Error while querying the Event Log." - } - $Result = New-Object -TypeName PSObject - $Result | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $Results - $Result | Add-Member -MemberType "NoteProperty" -Name "Severity" -Value $(if ($Results) { $BaseSeverity } else { $script:SeverityLevel::None }) - $Result + $Result = New-Object -TypeName PSObject + $Result | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $Results + $Result | Add-Member -MemberType "NoteProperty" -Name "Severity" -Value $(if ($Results) { $BaseSeverity } else { $script:SeverityLevel::None }) + $Result + } } function Invoke-SystemDriveCheck {