任务调度程序历史记录 - 获取已经启动的每个任务执行的命令和参数 - 使用PowerShell
任何人都会知道是否有可能从历史记录任务计划,命令和参数执行所有任务?
我有一个.ps1脚本,可以从任务调度程序历史记录中获取三个值:执行数据,任务名和结果代码。
$EventFilter = @{
LogName = 'Microsoft-Windows-TaskScheduler/Operational'
Id = 201 #action completed
StartTime = [datetime]::Now.AddDays(-10)
}
# PropertySelector for the Correlation id (the InstanceId) and task name
[string[]]$PropertyQueries = @(
'Event/EventData/Data[@Name="InstanceId"]'
'Event/EventData/Data[@Name="TaskName"]'
'Event/EventData/Data[@Name="ResultCode"]'
)
$PropertySelector = New-Object System.Diagnostics.Eventing.Reader.EventLogPropertySelector @(,$PropertyQueries)
# Loop through the start events
$TaskInvocations = foreach($StartEvent in Get-WinEvent -FilterHashtable $EventFilter){
# Grab the InstanceId and Task Name from the start event
$InstanceId,$TaskName,$ResultCode = $StartEvent.GetPropertyValues($PropertySelector)
# Create custom object with the name and start event, query end event by InstanceId
[pscustomobject]@{
TaskName = $TaskName
StartTime = $StartEvent.TimeCreated
ResultCode= $ResultCode
}
}
$TaskInvocations
现在我需要知道每个任务中执行的命令和参数是什么... 我什么都没找到... :-(我乞求认为这是不可能的...
请问吗
?
Anyone would know if it is possible to get from the history task schedules, the command and arguments executed of all the tasks ?
I have a .ps1 script that obtains from the task scheduler history, three values: data of execution, taskname and result code.
$EventFilter = @{
LogName = 'Microsoft-Windows-TaskScheduler/Operational'
Id = 201 #action completed
StartTime = [datetime]::Now.AddDays(-10)
}
# PropertySelector for the Correlation id (the InstanceId) and task name
[string[]]$PropertyQueries = @(
'Event/EventData/Data[@Name="InstanceId"]'
'Event/EventData/Data[@Name="TaskName"]'
'Event/EventData/Data[@Name="ResultCode"]'
)
$PropertySelector = New-Object System.Diagnostics.Eventing.Reader.EventLogPropertySelector @(,$PropertyQueries)
# Loop through the start events
$TaskInvocations = foreach($StartEvent in Get-WinEvent -FilterHashtable $EventFilter){
# Grab the InstanceId and Task Name from the start event
$InstanceId,$TaskName,$ResultCode = $StartEvent.GetPropertyValues($PropertySelector)
# Create custom object with the name and start event, query end event by InstanceId
[pscustomobject]@{
TaskName = $TaskName
StartTime = $StartEvent.TimeCreated
ResultCode= $ResultCode
}
}
$TaskInvocations
Now I need to know what was the command and arguments executed in each task...
I don't find anything... :-( I'm beggining to think that this is not possible...
any idea, please?
Thanks in advance.
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论