# From the Critical and Error Events, lists most recent 100
# Results are placed on desktop in CriticalErrorEvents.TXT
$NrEvents = 100
$ErrorActionPreference = "SilentlyContinue"
$logs = Get-WinEvent -ListLog * -Force -ea:silentlycontinue |
Where-Object{$_.ISEnabled -and $_.RecordCount}
$events = @()
Foreach ($log in $logs) {
$Events += Get-WinEvent -LogName $Log.logname -force -MaxEvents `
$NrEvents -ea:silentlycontinue |
where {($_.LevelDisplayName -match 'Critical') -OR `
($_.LevelDisplayName -match 'Error')} |
Select TimeCreated,ID, LevelDisplayName, Message }
$events | Sort TimeCreated -desc |select -first $NrEvents |
ft @{Label = "Created"; Expression = {$_.TimeCreated}},
@{Label = "Level"; Expression = {$_.LevelDisplayName}},
ID, Message -auto -wrap > $env:userprofile\Desktop\CriticalErrorEvents.TXT
EXIT
EXIT