Skip to content

Instantly share code, notes, and snippets.

@msm-fc

msm-fc/modify_custom_view.ps1

Created November 2, 2018 00:20
Show Gist options
  • Save msm-fc/88b5e3fd82830aec3531385584584e09 to your computer and use it in GitHub Desktop.
Save msm-fc/88b5e3fd82830aec3531385584584e09 to your computer and use it in GitHub Desktop.
Download ZIP
Inject new query into existing Event Viewer Custom View
Raw
modify_custom_view.ps1
#region config
$customViewFile = "path to custom view XML file"
$newCustomViewFile = "path to updated custom view XML file"
$newQuery = "*[System[Provider[@Name='Microsoft-Windows-WAS'] and (Level=3) and (EventID=5210)]]"
#endregion
#region operations
[xml]$customView = gc $customViewFile
$customview.SelectSingleNode("//Query").InnerText = $newQuery
$customView.Save($newCustomViewFile)
#endregion
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment