Retrieves events from all event logs during a given timespan

Note

Credits to Ruud Borst https://social.technet.microsoft.com/profile/ruud%20borst/

#requires -version 2

Param(
  [Parameter(ValueFromPipeline = $True,ValueFromPipelineByPropertyName = $True,HelpMessage = 'Enter the one or more hosts')] 
  [Alias('ComputerName','MachineName','Server','Host')]       
  [switch]$ExportToCsv,
  [string]$ExportToCSVPath = '.'
)

if (!([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator')) 
{
  Write-Warning -Message "This session is running under non-admin priviliges.`nPlease restart with Admin priviliges (runas Administrator) in order to read all logs on the system." -Debug
} # end if admin check

$Computer = $env:COMPUTERNAME

function Convert-XAMLtoWindow
{
  param
  (
    [Parameter(Mandatory = $True)]
    [string]
    $XAML,

    [string[]]
    $NamedElements,

    [switch]
    $PassThru
  )

  Add-Type -AssemblyName PresentationFramework

  $reader = [System.XML.XMLReader]::Create([System.IO.StringReader]$XAML)
  $result = [System.Windows.Markup.XAMLReader]::Load($reader)
  foreach($Name in $NamedElements)
  {
    $result | Add-Member -MemberType NoteProperty -Name $Name -Value $result.FindName($Name) -Force
  }

  if ($PassThru)
  {
    $result
  }
  else
  {
    $result.ShowDialog()
  }
}

Function Retrieve-Events 
{
  Param(            
    [Parameter(Mandatory = $True,HelpMessage = 'Please enter the full start date and time')] 
    [Alias('BeginDate','BeginTime','StartDate')]  
    [ValidateScript({
          (Get-Date $_)
    })]          
    [datetime]$StartTime,
    [Parameter(Mandatory = $True,HelpMessage = 'Please enter the full end date and time')] 
    [Alias('EndDate')]  
    [ValidateScript({
          (Get-Date $_)
    })]          
    [datetime]$EndTime
  )  

  $EventLogs = Get-WinEvent -ListLog * -ErrorVariable err -ea 0
  $err | ForEach-Object -Process {
    $warnmessage = $_.exception.message -replace '.*about the ', '' 
    Write-Warning -Message $warnmessage
  }

  $Count = $EventLogs.count

  $Events = $EventLogs |

  ForEach-Object -Process {
    $LogName = $_.logname
    $Index = [array]::IndexOf($EventLogs,$_)
    $Percentage = $Index / $Count
    $Message = "Retrieving events from Logs ($Index of $Count)"

    Write-Progress -Activity $Message -PercentComplete ($Percentage * 100) -CurrentOperation $LogName -Status 'Processing ...'

    Get-WinEvent -FilterHashtable @{
      LogName   = $LogName
      StartTime = $StartTime
      EndTime   = $EndTime
    } -ea 0
  } 

  if ($Events)
  {
    $Global:EventsSorted = $Events  |
    Sort-Object -Property timecreated |
    Select-Object -Property timecreated, id, logname, leveldisplayname, message 

    Write-Progress -Activity 'Almost there' -PercentComplete 100 -CurrentOperation 'Generating gridview output data ...' -Completed -Status 'Done'

    if ($ExportToCsv)
    {
      $exists = Test-Path $ExportToCSVPath

      if (!$exists) 
      {
        Write-Error -Message "$ExportToCSVPath doesn't exist, re-run script ..."
      }
      else 
      {
        $date = Get-Date
        $filename = "Events_$date`_$Computer.csv" -replace ':', '_'
        $filename = $filename -replace '/', '-'
        $EventsSorted | Export-Csv ($ExportToCSVPath + '\' + $filename)  -NoTypeInformation -Verbose
      } 
    }
    else 
    {
      try 
      {
        $EventsSorted |
        Out-GridView -Title 'Events Found'
      }
      catch 
      {
        Write-Warning -Message 'Error using the ''Out-GridView'' cmdlet, use the ''$EventsSorted'' variable to see all found events sorted on date and time. Or use the -ExportToCSV parameter with this script to Export the results to CSV'
        write-ouput ''
        Write-Warning -Message $_.exception.message
        break
      }
    } # end if exporttocsv 
  }
  else 
  {
    Write-Warning -Message "`n`n`nNo events found between $StartTime and $EndTime"
  }
} # end function

if ($PSVersionTable.psversion.major -lt 3)
{
  [void] [System.Reflection.Assembly]::LoadWithPartialName('System.Drawing') 
  [void] [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms') 

  $objForm = New-Object -TypeName System.Windows.Forms.Form 
  $objForm.Text = 'Retrieve All Events'
  $objForm.Size = New-Object -TypeName System.Drawing.Size -ArgumentList (525, 300) 
  $objForm.StartPosition = 'CenterScreen'

  $objForm.KeyPreview = $True
  $objForm.Add_KeyDown({
      if ($_.KeyCode -eq 'Enter') 
      {
        $x = $objTextBox.Text
        $objForm.Close()
      }
  })
  $objForm.Add_KeyDown({
      if ($_.KeyCode -eq 'Escape') 
      {
        $objForm.Close()
      }
  })

  $RetrieveButton = New-Object -TypeName System.Windows.Forms.Button
  $RetrieveButton.Location = New-Object -TypeName System.Drawing.Size -ArgumentList (200, 216)
  $RetrieveButton.Size = New-Object -TypeName System.Drawing.Size -ArgumentList (80, 25)
  $RetrieveButton.Text = 'Retrieve'
  $RetrieveButton.Add_Click({
      $timevalue1 = $objTextBox3 -split ' '
      $datevalue1 = $objLabel -split ' '
      $global:date1 = $datevalue1[2] + ' ' + $timevalue1[3]

      $timevalue2 = $objTextBox4 -split ' '
      $datevalue2 = $objLabel2 -split ' '
      $global:date2 = $datevalue2[2] + ' ' + $timevalue2[3]

      $StartTime = Get-Date $date1
      $EndTime = Get-Date $date2

      Retrieve-Events -StartTime $StartTime -EndTime $EndTime
  })

  $objForm.Controls.Add($RetrieveButton)

  $CurrentDate = Get-Date

  $Time2  = $CurrentDate.ToShortTimeString()
  $Time1  = ($CurrentDate).addhours(-1).ToShortTimeString()

  $objLabel = New-Object -TypeName System.Windows.Forms.DateTimePicker
  $objLabel.Location = New-Object -TypeName System.Drawing.Size -ArgumentList (12, 80)  
  $objForm.Controls.Add($objLabel) 

  $objLabel2 = New-Object -TypeName System.Windows.Forms.DateTimePicker
  $objLabel2.Location = New-Object -TypeName System.Drawing.Size -ArgumentList (250, 80) 
  $objForm.Controls.Add($objLabel2) 

  $objTextBox1 = New-Object -TypeName System.Windows.Forms.label
  $objTextBox1.Location = New-Object -TypeName System.Drawing.Size -ArgumentList (100, 40) 
  $objTextBox1.Text = 'Start'
  $objForm.Controls.Add($objTextBox1) 

  $objTextBox2 = New-Object -TypeName System.Windows.Forms.label
  $objTextBox2.Location = New-Object -TypeName System.Drawing.Size -ArgumentList (350, 40) 
  $objTextBox2.Text = 'End'
  $objForm.Controls.Add($objTextBox2) 

  $objTextBox3 = New-Object -TypeName System.Windows.Forms.DateTimePicker
  $objTextBox3.Location = New-Object -TypeName System.Drawing.Size -ArgumentList (12, 100) 
  $objTextBox3.Size = New-Object -TypeName System.Drawing.Size -ArgumentList (90, 20) 
  $objTextBox3.Format = 'Time' 
  $objTextBox3.ShowUpDown = $True
  $objTextBox3.Text = $Time1
  $objForm.Controls.Add($objTextBox3) 

  $objTextBox4 = New-Object -TypeName System.Windows.Forms.DateTimePicker
  $objTextBox4.Location = New-Object -TypeName System.Drawing.Size -ArgumentList (250, 100) 
  $objTextBox4.Size = New-Object -TypeName System.Drawing.Size -ArgumentList (90, 20) 
  $objTextBox4.Format = 'Time' 
  $objTextBox4.ShowUpDown = $True
  $objTextBox4.Text = $Time2
  $objForm.Controls.Add($objTextBox4) 

  $objForm.Topmost = $True

  $objForm.Add_Shown({
      $objForm.Activate()
  })
  [void] $objForm.ShowDialog()
}
else 
{
  $XAML = @'
<Window 
  xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
  xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
  Topmost="True" SizeToContent="Height"
  Title="Retrieve Events from all Event Logs"  Width="525" Height="450">

    <Grid Margin="0,0,9,4">
            <Grid.Background>
            <LinearGradientBrush EndPoint="0.5,1" StartPoint="0.5,0">
                <GradientStop Color="#d3d3d3" Offset="0.007"/>
                <GradientStop Color="#d3d3d3" Offset="1"/>
            </LinearGradientBrush>
        </Grid.Background>
        <Grid.ColumnDefinitions>
            <ColumnDefinition/>
        </Grid.ColumnDefinitions>

        <Grid.RowDefinitions>
            <RowDefinition Height="20*"/>
            <RowDefinition Height="Auto"/>
            <RowDefinition Height="20*"/>
        </Grid.RowDefinitions>

        <Button x:Name="Retrieve" Width="80" Height="25" 
            Margin="0,50,216,30" VerticalAlignment="Bottom" 
            HorizontalAlignment="Right" Content="Retrieve" Grid.Row="2"/>
        <TextBlock x:Name="Begin" HorizontalAlignment="Left" Margin="36,51,0,0" TextWrapping="Wrap" VerticalAlignment="Top" FontSize="14.667" FontWeight="Bold"/>
        <DatePicker x:Name="DateBegin" HorizontalAlignment="Left" Margin="36,71,0,0" VerticalAlignment="Top"/>
        <DatePicker x:Name="DateEnd" HorizontalAlignment="Left" Margin="297,71,0,0" VerticalAlignment="Top"/>
        <TextBox x:Name="Time1" HorizontalAlignment="Left" Height="23" Margin="138,71,0,0" TextWrapping="Wrap" VerticalAlignment="Top" Width="58" RenderTransformOrigin="1.296,-0.605"/>
        <TextBox x:Name="Time2" HorizontalAlignment="Left" Height="23" Margin="399,71,0,0" TextWrapping="Wrap" VerticalAlignment="Top" Width="58" RenderTransformOrigin="0.457,-3.533"/>
        <TextBlock x:Name="Begin1" HorizontalAlignment="Left" Margin="107,29,0,0" TextWrapping="Wrap" Text="Begin" VerticalAlignment="Top" FontSize="14.667"/>
        <TextBlock x:Name="End" HorizontalAlignment="Left" Margin="361,29,0,0" TextWrapping="Wrap" Text="End" VerticalAlignment="Top" FontSize="14.667"/>

    </Grid>

</Window>
'@

  $window = Convert-XAMLtoWindow -XAML $XAML -NamedElements 'Retrieve', 'Begin', 'DateBegin', 'DateEnd', 'Time1', 'Time2', 'Begin1', 'End' -PassThru


  $window.Retrieve.Add_MouseEnter(
    {
      $window.Cursor = [System.Windows.Input.Cursors]::Hand
    }
  )

  $window.Retrieve.Add_MouseLeave(
    {
      $window.Cursor = [System.Windows.Input.Cursors]::Arrow
    }
  )

  $window.Retrieve.add_Click(
    {
      $global:time1 = $window.Time1.text
      $global:time2 = $window.Time2.text
      $global:date1 = Get-Date ($window.DateBegin.SelectedDate -replace ' .*', " $Time1")
      $global:date2 = Get-Date ($window.DateEnd.SelectedDate -replace ' .*', " $Time2")
      $window.Cursor = [System.Windows.Input.Cursors]::AppStarting
      Retrieve-Events -StartTime $date1 -EndTime $date2
      $window.Cursor = [System.Windows.Input.Cursors]::Arrow
      [System.Object]$sender = $args[0]
      [System.Windows.RoutedEventArgs]$e = $args[1]
    }
  )


  $CurrentDate = Get-Date

  $window.DateBegin.add_Loaded(
    {
      $window.DateBegin.SelectedDate = $CurrentDate
      $window.DateEnd.SelectedDate = $CurrentDate
      $window.Time2.text = $CurrentDate.ToShortTimeString()
      $window.Time1.text = ($CurrentDate).addhours(-1).ToShortTimeString()
      [System.Object]$sender = $args[0]
      [System.Windows.RoutedEventArgs]$e = $args[1]
    }
  )

  $window.ShowDialog()
} # end if PowerShell version check

Write-Host -Object 'TIP: Use the $EventsSorted variable to interact with the results yourself.'