PowerShell evidence reference

Get-WinEvent queries

Filter event evidence by provider, channel, event ID, time, and structured payload.

Evidence to preserve

  • 1
    Use a narrow FilterHashtable
  • 2
    Preserve provider and timestamp
  • 3
    Export relevant properties or XML

How to use this reference safely

Start with the exact affected operation and collect the evidence above before selecting a repair branch. Change one relevant variable at a time, repeat the same operation, and preserve any changed result.

Official source: Microsoft PowerShell documentation
Confirm the cmdlet module, edition, version, privileges, target scope, and object output before acting.

Related PowerShell intelligence