locked
Get-EventLog: Attempted to perform an unauthorized operation RRS feed

  • Question

  • Hi,

    I am trying to pull event log information from another server on my network and I get the following error:

    Get-EventLog: Attempted to perform an unauthorized operation

    Firewall is off on both computers. Script is run as an admin. WINRM is running, but both servers are not in a domain. Is there a way to get around this error so I can pull this information remotely?

    Thanks

    Thursday, September 29, 2016 12:46 AM

Answers

  • You have to use the credentials for the admin on the remote machine.

    \_(ツ)_/

    • Marked as answer by RackHat Friday, September 30, 2016 6:35 PM
    Thursday, September 29, 2016 5:01 PM

All replies

  • You are not authorized to do the request you are trying to do. 

    Use the correct new CmdLet

    Get-WinEvent

    help Get-WinEvent -full


    \_(ツ)_/

    Thursday, September 29, 2016 1:40 AM
  • Thank you, however I am getting the exact same error when trying Get-WinEvent.

    Get-WinEvent : Attempted to perform an unauthorized operation.

    Thursday, September 29, 2016 1:35 PM
  • Either you command is written wrong, you are not an admin on the remote system or the remote system is corrupt.


    \_(ツ)_/

    Thursday, September 29, 2016 2:14 PM
  • Thanks, do these servers need to be in a domain for this? They both only have local users. 
    Thursday, September 29, 2016 4:45 PM
  • You have to use the credentials for the admin on the remote machine.

    \_(ツ)_/

    • Marked as answer by RackHat Friday, September 30, 2016 6:35 PM
    Thursday, September 29, 2016 5:01 PM
  • Thanks, the problem ended up being firewall setting for WINRM. After enabling that and running script using invoke-command as the local admin it worked great.
    Friday, September 30, 2016 6:39 PM
  • In my case I changed the script to use FQDN instead of NETBIOS name of the remote host and was able to remotely pull the logs after that. So seems to be maybe a DNS or name resolution issue. I'm also considering unchecking IPv6! 
    Wednesday, October 16, 2019 1:17 PM