事件日志和 powershell答案

【问题标题】：EventLog and powershell事件日志和 powershell
【发布时间】：2015-04-02 14:42:04
【问题描述】：

我有一个在创建新帐户时触发的脚本 (OnEvent 4720)。我从事件中获取数据并将其作为参数传递给 powershell 脚本。问题是某些名称带有撇号并且没有作为参数传递。

任务配置：

...
<Value name="DisplayName">Event/EventData/Data[@Name='DisplayName']</Value>
...

任务操作：

  <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Command>
  <Arguments>-Command c:\script\SendEmailNA.ps1 -SubjectUserSid '$(SubjectUserSid)' -SubjectUserName '$(SubjectUserName)' -SubjectDomainName '$(SubjectDomainName)' -SubjectLogonId '$(SubjectLogonId)' -TargetSid '$(TargetSid)' -TargetUserName '$(TargetUserName)' -TargetDomainName '$(TargetDomainName)' -SamAccountName '$(SamAccountName)' -DisplayName '$(DisplayName)' -UserPrincipalName '$(UserPrincipalName)' -HomeDirectory '$(HomeDirectory)' -HomePath '$(HomePath)' -ScriptPath '$(ScriptPath)' -ProfilePath '$(ProfilePath)' -UserWorkstations '$(UserWorkstations)' -PasswordLastSet '$(PasswordLastSet)' -AccountExpires '$(AccountExpires)' -PrimaryGroupId '$(PrimaryGroupId)' -AllowedToDelegateTo '$(AllowedToDelegateTo)' -OldUacValue '$(OldUacValue)' -NewUacValue '$(NewUacValue)' -UserAccountControl '$(UserAccountControl)' -UserParameters '$(UserParameters)' -SidHistory '$(SidHistory)' -LogonHours '$(LogonHours)' -PrivilegeList '$(PrivilegeList)'</Arguments>

SendEmailNA.ps1：

param($SubjectUserSid, $SubjectUserName, $SubjectDomainName, $SubjectLogonId, $TargetSid, $TargetUserName, $TargetDomainName, `
    $SamAccountName, $DisplayName, $UserPrincipalName, $HomeDirectory, $HomePath, $ScriptPath, $ProfilePath, $UserWorkstations, `
    $PasswordLastSet, $AccountExpires, $PrimaryGroupId, $AllowedToDelegateTo, $OldUacValue, $NewUacValue, $UserAccountControl, `
    $UserParameters, $SidHistory, $LogonHours, $PrivilegeList)

然后我使用变量来构造电子邮件的正文。当它是“John Lee”时一切正常，但当它是“John O'Connell”时它失败了。有人知道如何使用撇号传递参数吗？

谢谢

【问题讨论】：

只需用双引号替换引号就可以了SubjectUserName '$(SubjectUserName)' -> SubjectUserName "$(SubjectUserName)"
由于the single quotes，'$(SubjectUserName)' 将只是$(SubjectUserName)。
两种解决方案都不起作用。我在任务计划程序中收到错误：Task Scheduler successfully completed task "\Account created" , instance "{8988d714-1a94-4b86-bb88-b02ad87114a3}" , action "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" with return code 1.

标签： windows powershell events logging sysadmin

【解决方案1】：

找到答案了。

它不适用于 ps1 文件，但您可以使用 PowerGUI 将脚本编译为 .exe，然后它将传递一个带有撇号的参数。

【讨论】：