So now that we have our remote connections,
we've exported our log files,
how do we create this as a scheduled task using PowerShell so we can just leave
it running and it downloads all the log files that we need?
When we create scheduled tasks using PowerShell,
specifically on a Windows machine, of course,
there are a series of cmdlets.
The first one is the ScheduledTaskAction, so the thing that we want it to do.
Then there's the trigger, then there's the principal,
then there's any settings, then there's the task,
and then there's the registration of the scheduled task.
So the cmdlets themselves, if we look at the task action,
this will create an object that contains that definition of the action.
So this will represent whatever the command is that you
wish to execute as part of that task.
The trigger will be what kicks off that specific task.
So, for example, it could be a time‑based trigger,
so every day at 2 o'clock in the morning it executes,
or it could be some type of event.
Then we have the task principal.
This is the security context or the account that it needs to run under.
Then, of course, we have the settings set,
which is all of the specific settings that you have set for that task.
Then we say okay, now we're going to create the scheduled task,
which basically will create the object,
which is the definition of all of the other cmdlet information
tied together, and there's support for Win32,
Win16, OS/2, MS‑DOS, batch files, command files,
or basically any type of file that's registered.
Then our last command is the Register‑ScheduledTask.
This is the piece that actually creates that task.
So we take all of the output of all the rest,
and then we register that scheduled task.
So how do we create it in PowerShell?
Well, let's say our action here is to execute a specific PowerShell file,
so I've got a log file called Query‑Logs.
The trigger is going to be daily at 10 AM. My principal will be the
current TRAINING\trainer account, and the RunLevel is the Highest, so I
don't have any permission issues whatsoever.
My settings are going to be run only if the network is
available and then wake it up to run. And then my task itself
is a combination of all of those pieces. And then my register
is the registration of that task.
So, a scheduled task, in this instance, is going to execute
my PowerShell file to retrieve something.
So what does that query log look like?
Well, it's broken down into four pieces.
There's the definition of variables. There's a section for creating remote
sessions. We're also going to retrieve the logs using the remote sessions.
And then we're going to export those log files as CSV files. So my
scheduled task will execute a single PowerShell file for remote machines
and local machines and do all of the legwork, and it will do that on a
regular basis every day.