Powershell Error

[Mabrito]

Had a Powershell script working for some time now and noticed this morning it isn't working. I am seeing this error:

Specified argument was out of the range of valid values.
Parameter name: length
At C:\Users\xxx\Desktop\UserAudit - 4-2-15 Backup.ps1:202 char:5
+ $EventLogQuery = @"
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: ) [], ArgumentOutOfRangeException
+ FullyQualifiedErrorId : System.ArgumentOutOfRangeException

This error gets thrown when it approaches this step/variable assignemtn:

    $EventLogQuery = @"
    <QueryList>
    <Query Id="0" Path="Security">
        <Select Path="Security"> 
	    *[EventData[Data[@Name='LogonType'] and (Data ='10')]] 
	    and
        *[System[(EventID='4624')]]      
        </Select>
        <Suppress Path="Security">
	        *[EventData[Data[@Name='TargetUserName'] = 'SolarWinds.Admin']]
	        or 
	        *[EventData[Data[@Name='TargetUserName'] = 'Administrator']]
	    </Suppress>
    </Query>
    <Query Id="1" Path="Security">
        <Select Path="Security"> 
		    *[System[(EventID='4647')]] 
	    </Select>
        <Suppress Path="Security">
	        *[EventData[Data[@Name='TargetUserName'] = 'SolarWinds.Admin']]
	        or 
	        *[EventData[Data[@Name='TargetUserName'] = 'Administrator']]
	    </Suppress>
    </Query>
    </QueryList>
"@

At one point, I know this was working...so I am a little confused on whats its not liking about the $EventLogQuery variable assignment? If I comment out the variable assignment, no errors are thrown.

This is a Powershell script that uses XPath to fetch specific EventLog messages.

 

[Snowknight26]

Try removing the space in front of $EventLogQuery.

Strangely enough, though, it works for me if I copy/paste the above code into ISE.

 

[Mabrito]

Try removing the space in front of $EventLogQuery.

Strangely enough, though, it works for me if I copy/paste the above code into ISE.

Sigh....of course that would work.

Yeah I copy and pasted it, and all was fine. Something about how it was spaced in ISE or something....

Oh well...all is good now.

 

[Deleted member 16178]

The problem is that you are using here-strings and they are super finicky.

https://technet.microsoft.com/en-us/library/ee692792.aspx

I'd suggest using "Get-WinEvent" with the "-FilterHashtable" parameter.