Public/Start-AdfsServerTrace.ps1
|
<#
.SYNOPSIS Starts background jobs to search events based on AD FS Activity ID accross different computers .DESCRIPTION The Start-AdfsServerTrace cmdlet queries all computers' event logs for the activity ID supplied in parallel as background jobs. Use the Receive-AdfsServerTrace cmdlet to retrieve and combine the results This cmdlets works in AD FS 2.0 and later. .PARAMETER activityId Activity ID to search for. This typically comes from an AD FS error page. .PARAMETER ComputerName It is an array of computers, which represents the AD FS servers to try. .EXAMPLE Start-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -ComputerName @("ADFSSRV1","ADFSSRV2") Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df on Servers ADFSSRV1 and ADFSSRV2 .EXAMPLE Start-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -ComputerName (Get-Content .\Servers.txt) Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df from servers in a text file .EXAMPLE Start-AdfsServerTrace -ActivityId 00000000-0000-0000-9701-0080000000df -IncludeDebug -ComputerName @("ADFSSRV1","ADFSSRV2") Get Admin and Audits for activity ID 00000000-0000-0000-9701-0080000000df on Server ADFSSRV1 and ADFSSRV2, including debug traces .NOTES You need to run this function using an account that has permissions to read the event logs in all computers supplied. This is typically achieved having the account be part of the "Event Log Readers" Local Security Group. The computers supplied also should have firewall rules configured to allow remote readings. #> Function Start-AdfsServerTrace { Write-DeprecationNotice } |