Reading an event log remotely using Get-EventLog in Powershell

Question

I have a powershell script that runs on a server (test-server) and reads its client's log file (DC1).

• Both sides can ping each other.
• Firewalls are disabled on both sides.

• Remote Desktop and Remote Assistance are included in DC1.

  Get-EventLog System -ComputerName test-server -Source Microsoft-Windows-Winlogon # WORKS Get-EventLog System -ComputerName DC1 -Source Microsoft-Windows-Winlogon # DOESN'T WORK 

I run this script on a test server. As you can see, when I read the local log file on the test server, it works fine, but if I try to read the DC1 log file remotely, I get the error message “Get-EventLog: Network path not found”.

Error Screenshot:

How can I avoid this error and read the DC1 log file from the test server using Get-EventLog?

Answer 1

@ Lars Truijens proposal solved my problem. But other recommendations are also important to check.

So here is a checklist if you get this error when trying to retrieve log files remotely:

• Disable or set the firewall settings on both sides.
• Enable Remote Desktop and Remote Assistance on the client machine.
• Can you ping on a client machine?
• Run dir \\dc1\c$ to see that you are allowed a hard drive. (@Shay Levy suggestion)
• Run Get-Service -ComputerName YOURCOMPUTERNAME to see that you have reached the services. (@Shay Levy suggestion)
• Start the remote registry service. (@ Lars Truijens suggestion and it made it work for me)

Here is a screenshot of this solution:

Answer 2

Starting the RemoteRegistry service did not help me in this case.

Apparently, there is a difference between deletion accessed through the ComputerName parameter in some cmdlets, such as Get-Service, and a newer form of remote access, accessed using cmdlets such as Invoke-Command.

Since traditional remote access is implemented by individual cmdlets, it is inconsistent (uses different methods and requirements, different requirements) and are available only in selected cmdlets. The technology used for remote access may differ from the cmdlet and cmdlet, and not easily recognizable to you. Each cmdlet uses any remote technology its author has chosen. Most cmdlets use Remote Procedure Call (RPC), but may also require additional services and settings for the target system.

Starting with Windows PowerShell 2.0, there is an alternative and more universal way to access remote systems: Windows PowerShell Remoting. With this type of remote processing, Windows PowerShell provides remote access for all commands. It transfers your commands to the remote system using a relatively new and highly customizable WinRM service, executes the code in a separate session, which runs on the remote system and returns the results to the calling system.

http://powershell.com/cs/media/p/7257.aspx

When I replaced this command

 get-eventlog -LogName System -computername <ServerName> 

to that

 invoke-command {get-eventlog -LogName System} -ComputerName <ServerName> 

I no longer received the following error

get-eventlog: network path not found.