Query list of servers for a specific event in the log

If you encounter a situation When a KB package was installed, and you may need to get a list of servers that are pending reboot or just to see what systems are affected.

First, identify a system that you know was affected and search Event Viewer for the patching event.

Find the event id

Identify the log name i.e. System or Setup

Now you can use PowerShell to scan all the systems that were affected.

Review comments in code below and make required changes

#Written by Paul Zanbaka

#start time change in order to narrow the date/time

$StartTime=Get-Date -Year 2018 -Month 1 -Day 10 -Hour 12 -Minute 00

$EndTime=Get-Date  -Year 2018 -Month 1 -Day 11 -Hour 14 -Minute 00

#Enter the systems in Scan.txt

foreach ($ServerName in get-content C:\pzscripts\scan.txt) {

#This should be blank text file

$File ="C:\pzscripts\found.txt"

#Change Log Name, Event id and KB number

try {

write-Host $ServerName

Get-WinEvent -FilterHashtable @{logname = 'System'; id = 43;StartTime=$StartTime;EndTime=$EndTime } -ComputerName $ServerName -ErrorAction Stop | Select message |Select-String -SimpleMatch 'KB4038793' -AllMatches

 $ServerName  | Out-File $File  -Append

}

catch [Exception] {

        if ($_.Exception -match "No events were found that match the specified selection criteria") {

        Write-Host "No events found" -ForegroundColor red;

                 }

    }