Pilfered from here. More for my use than yours. ![]()
$BeginDate=[System.Management.ManagementDateTimeConverter]::ToDMTFDateTime((get-date).AddDays(-1)) get-wmiobject -class win32_ntlogevent -computerName $servername -filter "(EventCode=18453) and (LogFile='Application') and (TimeGenerated >'$BeginDate')"
Leave a comment