Powershell script gives different results when run manually

Question

I searched through the answers already on here, but didn't find anything I could say definitively answered my question. I have a script that should reach out to several servers as defined by a text file and report details from the EventLog. It also writes out to a file, emails the resulting file as an attachment, and gives me the amount of time it took to process the command, just so I can monitor the overall performance and see if there are any changes over time. That part works just fine.

Write-Output ($Start = Get-Date) | Out-File -Append F:\PowerShell\UnExpectedShutdowns.txt
$Computers = Get-Content -Path F:\PowerShell\servers.txt
Get-EventLog -logname System -ComputerName $Computers | ? {$_.TimeWritten -gt $lasttime -and $_.EventID -eq "6008"} | Format-Table -Wrap -Property MachineName, Index, TimeGenerated, EntryType, Source, InstanceID, Message -AutoSize | Out-File -Append -Force F:\PowerShell\UnExpectedShutdowns.txt
Write-Output (($Stop = Get-Date) - $Start).TotalSeconds | Out-File -Append F:\PowerShell\UnExpectedShutdowns.txt
Send-MailMessage -From sender@emaildomain.com -Subject "Daily Check for Server Shutdowns" -To receiver@emaildomain.com -Attachments F:\PowerShell\UnExpectedShutdowns.txt -Body "<p style=""font-family: Verdana, Geneva, sans-serif; font-size: 12px;"">Please review the attached document for new unexpected server shutdowns. </p><p>&nbsp;</p><p style=""font-family: Verdana, Geneva, sans-serif; font-size: 12px;"">The original file is located on <a href=""file:///\\SERVER\F$\Powershell\UnExpectedShutdowns.txt"">\\SERVER\F$\Powershell\UnExpectedShutdowns.txt</a></p><p style=""font-family: Verdana, Geneva, sans-serif; font-size: 12px;"">It should be pared down from time to time to maintain its size</p>" -BodyAsHtml -Priority Normal -SmtpServer smtp.dept.domain.com

I've added this as a scheduled task. If I Run outside of Task Scheduler manually, I get the results I expect.

MachineName                      Index TimeGenerated          EntryType Source   InstanceId Message                                                                     
-----------                      ----- -------------          --------- ------   ---------- -------                                                                     
SERVERNAME9999.fqdn             123456 3/10/2016 11:11:46 AM      Error EventLog 1234567890 The previous system shutdown at 11:08:17 AM on ‎3/‎10/‎2016 was unexpected. 

However, when I let it run on the schedule, I get results minus the last 2 columns (InstanceID & Message)

MachineName                      Index TimeGenerated          EntryType Source 
-----------                      ----- -------------          --------- ------ 
SERVERNAME9999.fqdn             123456 3/10/2016 11:11:46 AM      Error EventLo
                                                                        g      

As a scheduled task, I run it with an account that is in the administrator's group for all servers and I have the "Run with highest privileges" option checked. Why are my last 2 columns missing?

Answer 1

Like nkasco said, use Select and not Format-Table when outputting to file. This is likely due to Format-Table with -AutoSize or -Wrap since while running as a scheduled task under another user I don't think it can calculate the console size correctly and it's cutting off columns to fit. You shouldn't use Format-Table unless you are intending to output the result directly to the screen.

Also, use -After in your Get-EventLog so that each server only returns the date range needed instead of passing the entire event log across the wire and then forcing PowerShell to filter everything from there.

Get-EventLog -logname System -ComputerName $Computers -After $lasttime | ? {$_.EventID -eq "6008"} | Select MachineName, Index, TimeGenerated, EntryType, Source, InstanceID, Message | Out-File -Append -Force F:\PowerShell\UnExpectedShutdowns.txt