Powershell - property does not appear-CodePudding

I'm having great difficulty in putting the properties in the information that I export from the event log.

$event0 = Get-WinEvent -FilterHashTable @{Logname = 'Security'; ID = 4663 }
$events = $event0 | Select | Where { $_.Properties[9].Value -eq 65536 }

$teste = foreach ($event in $events) {
    $event2 = new-object psobject -Property @{
        TimeCreated = $event.TimeCreated
        EventID     = $event.Id
        User        = $event.Properties[1].Value
        Domain      = $event.Properties[2].Value
        LoginID     = $event.Properties[3].Value
        ObjectName  = $event.Properties[6].Value
        HandleID    = $event.Properties[7].Value
        ProcessName = $event.Properties[11].Value
        AccessMASK  = $event.Properties[9].Value
    }

    Write-Output "$($event2.TimeCreated), $($event2.EventId), $($event2.User), $($event2.Domain), $($event2.LoginID), $($event2.ObjectName), $($event2.HandleID), $($event2.ProcessName), $($event2.AccessMASK)" 
    $teste | ConvertTo-Html -Property TimeCreated, EventID, User, Domain, LoginID, ObjectName, HandleID, ProcessName, AccessMASK
}

$teste | Out-File -FilePath "Rel.html" -Append

the result shows the information without the property in the first row that serves to describe the data in each column.

CodePudding user response：

You need to do the Convert-HTML on the whole result list and not on each individual records.

Only then you'll get the headers as you exepect in the resulting HTML.

$event0 = Get-WinEvent -FilterHashTable @{Logname = 'Security'; ID = 4663 }


$events = $event0 | Where { $_.Properties[9].Value -eq 65536 }

$teste = foreach ($event in $events) {
    [PsCustomObject] @{
        TimeCreated = $event.TimeCreated
        EventID     = $event.Id
        User        = $event.Properties[1].Value
        Domain      = $event.Properties[2].Value
        LoginID     = $event.Properties[3].Value
        ObjectName  = $event.Properties[6].Value
        HandleID    = $event.Properties[7].Value
        ProcessName = $event.Properties[11].Value
        AccessMASK  = $event.Properties[9].Value
    }
}

#Uncomment below if you want to see the result in the console.
#$teste | Format-Table

# Convert all results to a HTML table
$teste | ConvertTo-Html -Property TimeCreated, EventID, User, Domain, LoginID, ObjectName, HandleID, ProcessName, AccessMASK  | Out-File -FilePath "Rel.html"