I would like to create some Windows Events for our Powershell Scripts.
One event we would like to create is when creating an AD object. Idea would be to create an event in onpostcreate. For this I would like to output the $Request in general if all infos are contained there. ( I know there are AR specific Windows Events)
Is the data from the created object present in the request in the onpostcreate function?
How to output a $Request user friendly? Goal would be to see all Attributes that where used in the creation of an AD Object
For Request Output i tried this
function onPostCreate($Request) { # Erstellung von Create Events $InitiatorSam = "" $InitiatorDistinguishedName = "" $Request.WhoAmi([ref]$InitiatorSam, [ref]$InitiatorDistinguishedName) $Event = @{ Source = 'CreateServiceUser' EventID = 21 EntryType = 'Information' Message = $Request InitiatorSam = $InitiatorSam Category = 1003 } Log $Event } function log() { if ($Event.ContainsValue("Information")) { [string]$Message = ($Event.Message.Attributes | Format-Table | Out-String) } Write-EventLog -Category $Event.Category -LogName "Active Roles Custom Scripts" -source $Event.Source -EventId $Event.EventID -EntryType $Event.EntryType -Message $Message }
output
Attributes PropertyCount ---------- ------------- {objectClass, description, userPrincipalName, sAMAccountName...} 18
and to convert to json
if ($Event.ContainsValue("Information")) { [string]$Message = ($Event.Message | Format-Table | ConvertTo-Json) }
Output
[ { "pageHeaderEntry": null, "pageFooterEntry": null, "autosizeInfo": null, "shapeInfo": { "hideHeader": false, "tableColumnInfoList": "Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo Microsoft.PowerShell.Commands.Internal.Format.TableColumnInfo", "ClassId2e4f51ef21dd47e99d3c952918aff9cd": "e3b7a39c089845d388b2e84c5d38f5dd" }, "groupingEntry": null, "ClassId2e4f51ef21dd47e99d3c952918aff9cd": "033ecb2bc07a4d43b5ef94ed5a35d280" }, { "shapeInfo": null, "groupingEntry": null, "ClassId2e4f51ef21dd47e99d3c952918aff9cd": "9e210fe47d09416682b841769c78b8a3" }, { "formatEntryInfo": { "formatPropertyFieldList": "Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField Microsoft.PowerShell.Commands.Internal.Format.FormatPropertyField", "multiLine": false, "ClassId2e4f51ef21dd47e99d3c952918aff9cd": "0e59526e2dd441aa91e7fc952caf4a36" }, "outOfBand": false, "writeStream": 0, "ClassId2e4f51ef21dd47e99d3c952918aff9cd": "27c87ef9bbda4f709f6b4002fa4af63c" }, { "groupingEntry": null, "ClassId2e4f51ef21dd47e99d3c952918aff9cd": "4ec4f0187cb04f4cb6973460dfe252df" }, { "groupingEntry": null, "ClassId2e4f51ef21dd47e99d3c952918aff9cd": "cf522b78d86c486691226b40aa69e95c" } ]