I am running a powershell script sensor on a remote windows machine. The script checks for logon audit failures:
$count = (get-eventlog security -after (get-date).AddDays(-1) | where {$_.instanceid -eq 4625}).count write-host "$count`:OK"
The script runs but returns "0:OK" on the sensor (and in the log), however if I run the script on the remote system it returns something different, like "6:OK"
I suspected that the script was returning a value from the PRTG host system, not the remote machine, which I verified with the following:
$hostName = hostname if($hostName -eq "PRTG"){write-host "1:OK"}else{write-host "2:OK"}
And sure enough, the sensor returned "1:OK". So despite the sensor being put in the remote system, it is not running the script on that system.
Not sure where to go from here.
Add comment