Pulling Event ID
I am wondering if there is a way for KACE to do a report where certain computers have had certain event ID's happen. Basically Event ID 41 and 6008, we are having users that are having BSOD but not minidump folder and the only thing we can see if the unexpected shutdown event ID;s.
Answers (1)
This should be not a big thing:
First you should write a short powershell script which reads out the Windows-Events (if you use W10 or W11 the Command is Get-WinEvent, before it was different) and grep the ID of your choice.
(something like Get-WinEvent -LogName THECORRECTLOGNAME | Where-Object { $.Id=EVENTID} )
And verify if there is a result or not.
Then put the results into a CIR and report it in the KACE.
(since I am on tour for this week I have no time to put this one liner together since I need some research for that (in which log the ID can be found for instance)
