Powershell – Export, zip, and email Windows Event Logs

This is a script that I made for our RMM that exports Windows Event Logs to a folder, zips the folder, then emails it to me. In my version, I set $CurrentUser by querying the registry keys of our A/V – I lucked out as the RMM runs all commands as SYSTEM and querying HKCU is a no-go. YMMV, and I recommend using a tool like RegistryFinder to search through your HKLM and see if you can find an instance of the currently logged in user to use as a variable for the script. 

				
					# Get variables to use for filenames
$CurrentUser = Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Registry-Key' -Name Registry-Value -ErrorAction SilentlyContinue 
$datetime = get-date -format yyyy-MM-dd_HHmmss
$hostname = hostname 

# Make new folder
mkdir C:\Export\EventLogs 

# Export log files to the folder
wevtutil epl Security C:\Export\EventLogs\$datetime`_$CurrentUser`_$hostname`_security.evtx 
wevtutil epl System C:\Export\EventLogs\$datetime`_$CurrentUser`_$hostname`_system.evtx 
wevtutil epl Application C:\Export\EventLogs\$datetime`_$CurrentUser`_$hostname`_application.evtx 

# Zip the folder containing the log files, name it with variables 
Compress-Archive -Path "C:\Export\EventLogs" -DestinationPath "C:\Export\$datetime`_$CurrentUser`_$hostname`_EventLogs.zip" -Force 

# Set variables for the email message 
$From = "mailbox@company.com" 
$To = "you@company.com" 
$Subject = "Event Logs - $hostname - $CurrentUser - $datetime" 
$Body = "Current user: $CurrentUser <br />Machine name: $hostname<br />Timestamp: $datetime" 

$SMTPServer = "smtp.domain.com" 
$SMTPPort = "587" 
$Priority = "High" 
$Attachment = "C:\Export\$datetime`_$CurrentUser`_$hostname`_EventLogs.zip" 

# Account name used to send email
$user = "mailbox@domain.com" 

# Password for sending account
$emailPass = ConvertTo-SecureString -String "XXXXXXXX" -AsPlainText -Force 

# Combine to create the sending credential
$credentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $user, $emailPass 

# Send-MailMessage with everything put together
Send-MailMessage -From $From -to $To -Subject $Subject -BodyAsHtml -Body $Body -SmtpServer $SMTPServer -port $SMTPPort -priority $Priority -UseSsl -Credential $credentials -DeliveryNotificationOption 'OnSuccess,OnFailure' -Attachments $Attachment 

# Clean everything up afterwards 
Remove-Item "C:\Export" -Recurse -Force
Tags