Windows Server Essentials 2016 retrieve event log details

[samsquared2]

I am trying to extract event log details for eventid 262 in the Microsoft-Windows-ServerEssentials/Admin event log which is under Applications and Services Logs. I've opened a Powershell session as administrator but when I run this:

Get-WinEvent -LogName "Microsoft-Windows-ServerEssentials/Admin" -FilterHashTable @{ID=262} | Format-List *

I get the following error:

Get-WinEvent : Parameter set cannot be resolved using the specified named parameters.
At line:1 char:1
+ Get-WinEvent -LogName "Microsoft-Windows-ServerEssentials/Admin" -Fil ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: ) [Get-WinEvent], ParameterBindingException
+ FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.PowerShell.Commands.GetWinEventCommand

Does something else need to be included because the log is under "Applications and Services Logs"?

 

[ChatGPT]

The error is because you mixed the -LogName parameter with a -FilterHashTable call in a way that puts Get-WinEvent into an ambiguous parameter set. The simple fix is to put the log/channel name inside the hashtable (or else omit -FilterHashTable and filter afterwards).
Try one of these (run in an elevated PowerShell):
1) Recommended — filter server-side and show full details
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} | Format-List *
2) Select only the useful fields (more readable)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} -MaxEvents 50 |
Select-Object TimeCreated, RecordId, Id, LevelDisplayName, ProviderName, Message |
Format-List
3) If you prefer to see the raw XML for the event(s)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} |
ForEach-Object { $_.ToXml() } > C:\Temp\ServerEssentials_Event262.xml
4) If you want to filter after reading (less efficient)
Get-WinEvent -LogName 'Microsoft-Windows-ServerEssentials/Admin' |
Where-Object { $_.Id -eq 262 } |
Format-List *
Notes and tips

• Make sure you run PowerShell elevated (you said you already did).
• If the channel name contains characters, keep it quoted exactly as above.
• If you expect many matching events, add -MaxEvents N to limit results.
• To capture output to a text file use Out-File or >, e.g.:
  Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} | Format-List * | Out-File C:\Temp\Event262.txt -Encoding UTF8

If you’d like, run the recommended command (option 1 or 2) and paste the output (or the C:\Temp file) here and I’ll review the event contents and suggest the next repair steps.

 

[samsquared2]

Thanks for your help. I used option 2 and selected 'Message' but now I want to have that be the body of the email in the SendMessage. Using

-Body $msg

fails with invalid argument and

-Body [string]$msg

yields useless gibberish. What is the correct format for the SendMessage?

 

[ChatGPT]

Good — you were close. The problem was the type/shape of what you put into $msg. Send-MailMessage expects a plain string (or byte-encodable text) for -Body. If $msg contains EventRecord objects, arrays, XML nodes, or a formatted object stream, casting ([string]$msg) can produce odd output. The reliable approach is to extract/format the text you want and convert that to a single string (Out-String or -join) before passing it to -Body.
Here are several safe, copy/paste-ready ways to build $msg and call Send-MailMessage.
1) Simple — send the Message field from the latest matching event

get one event​

$evt = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} -MaxEvents 1

extract the textual Message property​

$msg = $evt.Message

send​

Send-MailMessage -SmtpServer 'smtp.smtp2go.com' -Port 587 -UseSsl -Credential $cred `
-From 'sam@samcox.org' -To 'you@domain.tld' -Subject "Event 262" -Body $msg -Encoding UTF8
2) Multiple events — join their Message texts into one body
$events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} -MaxEvents 10
$msg = ($events | ForEach-Object { $.TimeCreated.ToString('u') + " - EventId:$($.Id)n" + $_.Message }) -join "rnrn----rn" Send-MailMessage -SmtpServer 'smtp.smtp2go.com' -Port 587 -UseSsl -Credential $cred
-From 'sam@samcox.org' -To 'you@domain.tld' -Subject "Recent Event 262s" -Body $msg -Encoding UTF8
3) If you want the formatted output you saw with Format-List
(Format-* returns formatted objects for the console, not a string — use Out-String)
$msg = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} -MaxEvents 5 |
Select-Object TimeCreated, RecordId, Id, LevelDisplayName, ProviderName, Message |
Format-List | Out-String -Width 4096
Send-MailMessage -SmtpServer 'smtp.smtp2go.com' -Port 587 -UseSsl -Credential $cred `
-From 'sam@samcox.org' -To 'you@domain.tld' -Subject "Event 262 (formatted)" -Body $msg -Encoding UTF8
Notes and tips

• Use -ExpandProperty when you want raw property text:
  Get-WinEvent ... | Select-Object -ExpandProperty Message
  This returns plain strings (not objects), which you can -join.
• If your message contains newlines, Send-MailMessage handles them fine. Use n orr`n for line breaks when joining.
• If you had “gibberish” when casting to [string], you were probably casting an object type (EventRecord) or an XML blob. The approaches above return plain text.
• If you need HTML body, build HTML into $msg and use the -BodyAsHtml switch:
  Send-MailMessage ... -Body $msg -BodyAsHtml
• Use -Encoding UTF8 to avoid character set problems for non-ASCII characters.

Example end-to-end (pasteable)

get last event 262​

$evt = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ServerEssentials/Admin'; Id=262} -MaxEvents 1

create a readable body​

$msg = "Time: $($evt.TimeCreated)nEventID: $($evt.Id)nSource: $($evt.ProviderName)nn$($evt.Message)"

SMTP credential object​

$cred = New-Object System.Management.Automation.PSCredential('SMTP2GO_USERNAME',(ConvertTo-SecureString 'SMTP2GO_PASSWORD' -AsPlainText -Force))

send​

Send-MailMessage -SmtpServer 'smtp.smtp2go.com' -Port 587 -UseSsl -Credential $cred `
-From 'sam@samcox.org' -To 'you@domain.tld' -Subject "ServerEssentials Event 262" -Body $msg -Encoding UTF8
If you paste the exact code you used to build $msg (and the error text you saw when using -Body $msg), I’ll point out precisely what type you actually had and what change will fix it.