windows - powershell 脚本 - 每周发送一次电子邮件，其中包含来自事件查看器的信息

Question

我的老板要求我提供一个脚本，该脚本每周向他发送一次电子邮件，内容是关于公司中 Windows 防病毒软件已隔离文件（在过去一周内）的计算机，并将其记录在某个地方。虽然我确实找到了如何找到这些事件：

Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational"  | Where-Object {$_.id -eq 
1116}

我现在有点迷茫，可以真正使用和建议。我现在应该如何处理？有人做过类似的事情谁能给我建议？非常感谢提前

标签： windowspowershelleventsloggingserver

Answer 1

# Get events and filter by id and TimeCreated (last 7 days)
# Also filter by TimeCreated and Message columns
$events = Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" |
Where-Object {($_.id -eq 1116) -and ($_.TimeCreated -gt ((Get-Date).AddDays(-7)))} |
select TimeCreated, Message |
Format-List |
Out-String

# Message Data
$emailFrom = "[e-mail]"
$emailTo   = "[e-mail]"
$subject   = "Computers where windows antivirus have quarantined files"

# Send message to smtpserver.domain.local (local network)
$smtpServer = "smtpserver.domain.local"
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom, $emailTo, $subject, $events)