PowerShell 远程事件日志解析

Question

我编写了一个小脚本来从远程机器中获取事件日志条目并将其写入 .csv 文件。该脚本在针对单台计算机时有效，但是当我尝试实现 for 循环并将其循环到 Active Directory 中的所有计算机时，我收到此错误：

Method invocation failed because [Microsoft.ActiveDirectory.Management.ADComputer] 
does not contain a method named 'op_Addition'.
At Y:\srp.ps1:7 char:143
+ ... | Export-Csv $($computer + ".csv")
+                    ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (op_Addition:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

Export-Csv : Cannot validate argument on parameter 'Path'. The argument is null or empty. 
Provide an argument that is not null or empty, and then try the command again.
At Y:\srp.ps1:7 char:141
+ ... 0 | Export-Csv $($computer + ".csv")
+                    ~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [Export-Csv],
                              ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,
                              Microsoft.PowerShell.Commands.ExportCsvCommand

该错误表明 Export-Csv 命令存在问题，但单独运行该命令会创建所需的日志文件。这是完整的脚本，供参考：

# Gets SRP event log entries from remote machine and writes them to a .csv file 
# of the same name.

Write-Output "Running..."

$computers = Get-ADComputer -filter {(Name -like "PC*") -or (Name -like "LT*")}
foreach ($computer in $computers) {
    Get-EventLog -LogName Application -Source Microsoft-Windows-SoftwareRestrictionPolicies 
    -ComputerName $computer -Newest 10 | Export-Csv $($computer + ".csv")
} #end foreach

Write-Host "Done."

关于我尝试在 AD 中循环计算机时为什么会出现此错误的任何想法？

Answer 1

看起来Get-ADComputer 返回ADComputer 对象，但您将其传递给Get-EventLog 的ComputerName 参数，该参数按原样接受一个字符串。我假设您需要从 Microsoft.ActiveDirectory.Management.ADComputer 对象中获取 name 属性。