For the cmdlet mentioned, you could get info by doing the following.
Tested on
(Get-CimInstance -ClassName Win32_OperatingSystem).Version
# Results
<#
10.0.19041
#>
This works in getting the info
(Get-WinEvent -LogName 'Microsoft-Windows-NetworkProfile/Operational').Count
# Results
<#
2054
#>
Get-WinEvent -LogName 'Microsoft-Windows-NetworkProfile/Operational' |
Select-Object -First 3 |
Format-Table -AutoSize
# Results
<#
ProviderName: Microsoft-Windows-NetworkProfile
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
09-Jul-20 08:54:25 4004 Information Network State Change Fired...
09-Jul-20 08:54:22 4004 Information Network State Change Fired...
09-Jul-20 08:54:18 20002 Information NSI Set Category Result...
#>
You can only get the properties present then you have to ask for text in the property
(Get-WinEvent -LogName 'Microsoft-Windows-NetworkProfile/Operational' |
Select-Object -First 1) |
Sort-Object -Property Name |
Get-Member
# Results
<#
TypeName: System.Diagnostics.Eventing.Reader.EventLogRecord
Name MemberType Definition
---- ---------- ----------
...
Message NoteProperty string Message=Network State Change Fired...
...
Id Property int Id {get;}
Keywords Property System.Nullable[long] Keywords {get;}
KeywordsDisplayNames Property System.Collections.Generic.IEnumerable[string] KeywordsDisplayNames {get;}
Level Property System.Nullable[byte] Level {get;}
LevelDisplayName Property string LevelDisplayName {get;}
LogName Property string LogName {get;}
MachineName Property string MachineName {get;}
...
ProcessId Property System.Nullable[int] ProcessId {get;}
Properties Property System.Collections.Generic.IList[System.Diagnostics.Eventing.Reader.EventProperty] Properties {get;}
...
ProviderName Property string ProviderName {get;}
...
RecordId Property System.Nullable[long] RecordId {get;}
RelatedActivityId Property System.Nullable[guid] RelatedActivityId {get;}
Task Property System.Nullable[int] Task {get;}
TaskDisplayName Property string TaskDisplayName {get;}
ThreadId Property System.Nullable[int] ThreadId {get;}
TimeCreated Property System.Nullable[datetime] TimeCreated {get;}
...
#>
Event logs store details in the Message property and you can select from there.
(Get-WinEvent -LogName 'Microsoft-Windows-NetworkProfile/Operational').Message |
Select-Object -First 1
# Results
<#
Network State Change Fired
New Internet Connection Profile: false
Connection Cost Changed: false
Domain Connectivity Level Changed: false
Network Connectivity Level Changed: false
Host Name Changed: true
Wwan Registration State Changed: false
Tethering Operational State Changed: false
Tethering Client Count Changed: false
#>
You can use a hash table to filter for your ID
Get-WinEvent -FilterHashTable @{
LogName = 'Microsoft-Windows-NetworkProfile/Operational'
ID = 10000
}
# Results
<#
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
09-Jul-20 08:54:18 10000 Information Network Connected...
09-Jul-20 08:54:14 10000 Information Network Connected...
09-Jul-20 08:54:08 10000 Information Network Connected...
...
#>
Then it's a matter of parsing that Message into the format you choose.
Or just ask for the whole message as is
(Get-WinEvent -FilterHashTable @{
LogName = 'Microsoft-Windows-NetworkProfile/Operational'
ID = 10000
}).Message
Or
(Get-WinEvent -FilterHashTable @{
LogName = 'Microsoft-Windows-NetworkProfile/Operational'
ID = 10000
}) | Select-Object -ExpandProperty Message
See also:
Update
As LeeDaily points out, you might just be better served just setting this in TaskScheduler. If you did a direct filter config in EventViewer, you get stuff like this.
<QueryList>
<Query Id="0" Path="Microsoft-Windows-NetworkProfile/Operational">
<Select Path="Microsoft-Windows-NetworkProfile/Operational">*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5) and (EventID=10000)]]</Select>
</Query>
</QueryList>
So, you can see the limitation of what you can natively return, and then specifically saying, if you want more, you have to dig at the Message Property value. Take a deeper look at the XML info in the link provided where when you do you end up with code like the below, with all possible output.
# Collect the filtered events
$Events = Get-WinEvent -FilterHashTable @{
LogName = 'Microsoft-Windows-NetworkProfile/Operational'
ID = 10000
} -MaxEvents 1
# Parse out the event message data
ForEach ($Event in $Events)
{
# Convert the event to XML
$eventXML = [xml]$Event.ToXml()
# Iterate through each one of the XML message properties
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++)
{
# Append these as object properties
$AddMemberSplat = @{
InputObject = $Event
MemberType = 'NoteProperty'
Force = $true
Name = $eventXML.Event.EventData.Data[$i].Name
Value = $eventXML.Event.EventData.Data[$i].'#text'
}
Add-Member @AddMemberSplat
}
}
# View the results
$Events | Select-Object * | Format-List
Microsoft-Windows-NetworkProfile/Operational
withGet-EventLog -LogName
, it says the event log does not exist. – Ben Wo Jul 9 '20 at 20:32Get-WinEvent -ListLog *network*
<<< it shows up on my old win7ps5.1 box. – Lee_Dailey Jul 9 '20 at 21:57