0

When I have 1 computer in $ComputerName it works but when I add another computer name it gives error.[Code & Error][1] Sorry about that, Following is the code:

$ComputerName = 'Server1','Server2' ForEach($Computer in $ComputerName){ $Info = Get-WinEvent -ComputerName $Computer -FilterHashTable @{Logname='System';ID=1074,6008,1076} | Sort-Object MachineName, TimeCreated, ID | Group-Object MachineName, TimeCreated, ID, Message | Select-Object @{N="Computer";E={$_.Group[0].MachineName}}, @{N="TimeCreated"; E={$.Group[0].TimeCreated}}, @{N="Error ID";E={$_.Group[0].ID}}, @{N="Message"; E={$.Group[0].Message.Replace("r",' ').Replace("n",' ')}} ` | Export-Csv -NoTypeInformation -Path C:\ServerLogs\events3.csv;}

ERROR:

Get-WinEvent : The RPC server is unavailable At C:\EventLogs\TEST.ps1:3 char:9

  • $Info = Get-WinEvent -ComputerName $Computer -FilterHashTable @{Logn ...
  •     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : NotSpecified: (:) [Get-WinEvent], EventLogException
    • FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWinEventCommand
Danish Hassan
  • 1
  • 2

1 Answers1

1

"The RPC server is unavailable" usually indicates your RPC connection was blocked, either to Firewall or permissions issues. Rarely the RPC services have stopped on the remote host. Windows Firewall is most common in my experience and you can look to ensure your Firewall policy is set to allow 'Remote Event Log Management (RPC)' and that the rule is Enabled. There's a built-in rule to allow this. You shouldn't need to build a custom one. And I'd avoid the 'Remote Assistance' rule that some blogs mention. That can be a dangerous level of access.

OttScott
  • 21
  • 4