The easiest approach for me is to look for event log entries that show that the Event Log service was started.
This can be done by filtering inside the Event Log console but I prefer this PowerShell one-liner that checks for these entries during the past 24 hours:
Get-EventLog -After
$(Get-Date).AddHours(-24) -EntryType Information -Source
EventLog -LogName
System |
Where {$_.EventID -eq "6005"}
No comments:
Post a Comment