locked
Can't access Win32_NTLogEvent class remotely from WMI RRS feed

  • Question

  • I'm trying to read my Windows 7 virtual machine Security logs remotely from base machine via WMI. I am able to connect it via WMI and access other classes such as Win32_OperatingSystems and all but I can't access Win32_NTLogEvent class.  
    I have given fullrights, remote enable and read security permissions to Authenticated users in WMI properties.
    Do I have to give some extra rights to read logs? if yes, then which rights?  
    please help.  
    Thank you.
    Thursday, March 8, 2018 1:15 PM

Answers

  • Thanks jrv , that was of great help. 

    Although , I was trying to query using wbemtest but was not able to connect. So I looked as you suggested for Get-WinEvent and tried this and it happened to fix my actual problem of connecting via wbemtest.

    • Marked as answer by Bill_Stewart Tuesday, May 8, 2018 6:56 PM
    Saturday, March 10, 2018 2:49 PM

All replies

  • Use Get-WinEvent. It is more efficient and more powerful than the WMI provider.

    help Get-WinEvent -Online


    \_(ツ)_/

    Thursday, March 8, 2018 10:15 PM
  • Thanks jrv , that was of great help. 

    Although , I was trying to query using wbemtest but was not able to connect. So I looked as you suggested for Get-WinEvent and tried this and it happened to fix my actual problem of connecting via wbemtest.

    • Marked as answer by Bill_Stewart Tuesday, May 8, 2018 6:56 PM
    Saturday, March 10, 2018 2:49 PM