Schedule a powershell script

When certain task has run, its nice to be notified. since email function is deprecated in taskscheduler we have to pull out powershell.

1. Create the script

-------sendmail.ps1-----

param([string]$task)
$psemailserver = "smtp.mycompany.com"
$receiver = john.doe@company.com
$from = task@company.com
$subject = "Task has run"
$body = "Scheduled task $task has run. "
send-mailmessage -to $receiver -from $from -subject $subject -body $body
write-host "Mail sent for $task"
write-eventlog -logname Application -source "my script" -entrytype information -eventid 1 -message "$task has run"
------eof----

2. Create the call using Task Scheduler “powershell –file “c:\myfile\sendmail.ps1” “helloworld”

What the script does is take an input variable and sending an email using defined smtpserver in the script. When mail is sent, it also logs en event in the application eventlog with source “my script”. The param is optional, but helpful if you want more reusability.

The source needs to created the first time manually, or use an already existing source.

Create source “my script” in application

/>New-eventlog –logname application –source ”my script”

References:

http://blogs.technet.com/b/heyscriptingguy/archive/2013/06/20/how-to-use-powershell-to-write-to-event-logs.aspx

http://blogs.technet.com/b/heyscriptingguy/archive/2012/08/11/weekend-scripter-use-the-windows-task-scheduler-to-run-a-windows-powershell-script.aspx

http://stackoverflow.com/questions/16426688/passing-a-variable-to-a-powershell-script-via-command-line

Custom Views in Server 2008 R2

Recently I had a request to create a logging system for usage on a server. A way to document how many times a machine is logged onto by a specific subset of users.
I though I would try out the custom views in Server 2008 R2 instead of making the quick and easy script at logon/logoff.
It turned out a bit more complicated than I anticipated so here it is, for documenting purposes.
1. Make sure logon events are audited in local security policy or domain policy.
2. Create a custom view from the Security Log
3. Choose tab XML and ‘Edit query manually’
4. My end result 

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
    *[System[(EventID=4624 or EventID=4647)]]
    and
    *[EventData[Data[@Name='TargetUserName'] and (Data = 'user1' or Data='user2')]]
    </Select>
  </Query>
</QueryList>

The specific properties of the event you want to log can be found by viewing XML view on the relevant event. In my case the TargetUserName was the common unit for the relevant IDs.

The cool thing about custom events is that you can attach a task to the view, allowing a program or email to be sent every time something is logged.
References:
http://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx