How do I get the Task History on a remote machine?

Question

I'm trying to get the task history (when I get the task list of the same remote machine in the GetTaskFromRemoteServer method, it is working) but everytime the program gets to the "Console.WriteLine(log.First().Level)" line, I get the following exception : System.Diagnostics.Eventing.Reader.EventLogException. When I look at the error message, it says "RPC server in unavailable". I have checked the RPC service and it is working.

I'm using the TaskScheduler package created by David Hall (v. 2.8.0). About the TaskEventLog constructor, it says that "If you use the TaskEventLog constructor which specifies a remote machine, you will need to use impersonation to logon to an account with privileges to the remote machine". I think I might be missing something here. I'm not sure if I'm doing this part correctly (use impersonation to logon to an account with privileges to the remote machine).

public void GetTaskFromRemoteServer(string taskname, string servername, string username, string password, string folderName = null)
{
    using (TaskService ts = new TaskService(servername, username, DOMAIN, password))
    {
        Console.WriteLine("Listing tasks from the following server: " + servername);

        TaskFolder tf;
        if(folderName != null) tf = ts.GetFolder(folderName);
        else tf = ts.RootFolder;

        foreach (Task task in tf.Tasks)
        {
            string curTaskName = task.Name;
            if (curTaskName == taskname)
            {
                Console.WriteLine(curTaskName);
                GetTaskHistory(servername, task.Path, username, password);
            }
        }
    }
}

public void GetTaskHistory(string servername, string taskPath, string username, string password) 
{
    TaskEventLog log = new TaskEventLog(servername, taskPath, DOMAIN, username, password);

    Console.WriteLine(log.First().Level); 
    Console.WriteLine(log.First().TimeCreated.ToString());
    Console.WriteLine(log.First().EventId.ToString());
}

Stacktrace :

L'exception System.Diagnostics.Eventing.Reader.EventLogException n'a pas été gérée
  HResult=-2146233088
  Message=Le serveur RPC n’est pas disponible
  Source=System.Core
  StackTrace:
       à System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
       à System.Diagnostics.Eventing.Reader.NativeWrapper.EvtQuery(EventLogHandle session, String path, String query, Int32 flags)
       à System.Diagnostics.Eventing.Reader.EventLogReader..ctor(EventLogQuery eventQuery, EventBookmark bookmark)
       à System.Diagnostics.Eventing.Reader.EventLogReader..ctor(EventLogQuery eventQuery)
       à Microsoft.Win32.TaskScheduler.TaskEventLog.GetEnumerator(Boolean reverse)
       à Microsoft.Win32.TaskScheduler.TaskEventLog.System.Collections.Generic.IEnumerable<Microsoft.Win32.TaskScheduler.TaskEvent>.GetEnumerator()
       à System.Linq.Enumerable.First[TSource](IEnumerable`1 source)
       à TaskSchedulerWatcher.TaskSchedulerAccess.GetTaskHistory(String servername, String taskPath, String username, String password) dans c:\Users\abc\Documents\Workspace\TaskSchedulerWatcher\TaskSchedulerWatcher\TaskSchedulerAccess.cs:ligne 49
       à TaskSchedulerWatcher.TaskSchedulerAccess.GetTaskFromRemoteServer(String taskname, String servername, String username, String password, String folderName) dans c:\Users\abc\Documents\Workspace\TaskSchedulerWatcher\TaskSchedulerWatcher\TaskSchedulerAccess.cs:ligne 38
       à TaskSchedulerWatcher.Program.Main(String[] args) dans c:\Users\abc\Documents\Workspace\TaskSchedulerWatcher\TaskSchedulerWatcher\Program.cs:ligne 18
       à System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
       à System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
       à Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
       à System.Threading.ThreadHelper.ThreadStart_Context(Object state)
       à System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
       à System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
       à System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
       à System.Threading.ThreadHelper.ThreadStart()
  InnerException:

score 0 · Accepted Answer · answered Apr 03 '18 at 09:36

Assuming you have the correct credentials, i think this will turn out to be a firewall issue, or a windows setting on the remote computer.

The RPC server is unavailable

Seems to be a common problem with accessing event viewer from a remote computer and various other things , and not just limited to the EventLogReader which this is based on

There are lots of hits on this on google, most point at the firewall. id apply the following firewall rules first and work backwards. Or for a test completely disable it

COM+ Network Access (DCOM-In)
Remote Event Log Management (NP-In)
Remote Event Log Management (RPC)
Remote Event Log Management (RPC-EPMAP)
Windows Management Instrumentation (ASync-In)
Windows Management Instrumentation (DCOM-In)
Windows Management Instrumentation (WMI-In)

How do I get the Task History on a remote machine?

1 Answers1