Powershell Error

Mabrito

Supreme [H]ardness
Joined
Dec 24, 2004
Messages
7,004
Had a Powershell script working for some time now and noticed this morning it isn't working. I am seeing this error:

Specified argument was out of the range of valid values.
Parameter name: length
At C:\Users\xxx\Desktop\UserAudit - 4-2-15 Backup.ps1:202 char:5
+ $EventLogQuery = @"
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: :)) [], ArgumentOutOfRangeException
+ FullyQualifiedErrorId : System.ArgumentOutOfRangeException

This error gets thrown when it approaches this step/variable assignemtn:
Code:
    $EventLogQuery = @"
    <QueryList>
    <Query Id="0" Path="Security">
        <Select Path="Security"> 
	    *[EventData[Data[@Name='LogonType'] and (Data ='10')]] 
	    and
        *[System[(EventID='4624')]]      
        </Select>
        <Suppress Path="Security">
	        *[EventData[Data[@Name='TargetUserName'] = 'SolarWinds.Admin']]
	        or 
	        *[EventData[Data[@Name='TargetUserName'] = 'Administrator']]
	    </Suppress>
    </Query>
    <Query Id="1" Path="Security">
        <Select Path="Security"> 
		    *[System[(EventID='4647')]] 
	    </Select>
        <Suppress Path="Security">
	        *[EventData[Data[@Name='TargetUserName'] = 'SolarWinds.Admin']]
	        or 
	        *[EventData[Data[@Name='TargetUserName'] = 'Administrator']]
	    </Suppress>
    </Query>
    </QueryList>
"@

At one point, I know this was working...so I am a little confused on whats its not liking about the $EventLogQuery variable assignment? If I comment out the variable assignment, no errors are thrown.

This is a Powershell script that uses XPath to fetch specific EventLog messages.
 
Try removing the space in front of $EventLogQuery.

Strangely enough, though, it works for me if I copy/paste the above code into ISE.
 
Try removing the space in front of $EventLogQuery.

Strangely enough, though, it works for me if I copy/paste the above code into ISE.

Sigh....of course that would work.

Yeah I copy and pasted it, and all was fine. Something about how it was spaced in ISE or something....

Oh well...all is good now.
 
Back
Top