For some reason i'm not getting this custom exe sensor working. It keeps giving me this error:
Failed to open event query. Access is denied.
If I run the .ps1 there's no problem. I'm sure the credentials are ok because this sensor is a part of a bigger object and credentials are inherited. Also I see the powershell.exe run as the inherited user when checking taskmanager. When I connect from the PRTG server to the evenvwr of the target server with the credentials there's no problem. Anybody any idea's?
$xml = wevtutil /r:server.domain.local qe Microsoft-Windows-Hyper-V-Integration-Admin /e:root "/q:*[System[(Level=3) and (EventID=4130) and TimeCreated[timediff(@SystemTime) <= 86400000]]]" $xmlData = [xml]$xml $result=[string]$xmldata.root.event.count+":OK" write-host $result