SERVER-031 · Script

Review Server Event Logs

Collects recent critical, error and warning events from servers and summarizes them by source and event ID.

Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing

What it does

Reads the logs you choose (System and Application by default) from each target server for the last -Hours hours, at the levels you choose (Critical and Error by default). Writes two CSV files:

Summary: one row per server, log, source and event ID, with a count, first and last time seen,

and a sample message, sorted with the noisiest first

Details: every event read (up to -MaxEvents per server and log)

Use it for a morning check or a weekly review instead of opening Event Viewer on each server. Targets are the servers you name, the servers in an OU, or this computer. Read-only.

Requirements

Windows PowerShell 5.1. Membership in Event Log Readers (or admin) on the targets, with remote event log access allowed. The ActiveDirectory module (RSAT) only when -SearchBase is used.

How to run it

Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
Script type: PowerShell 5.1, 64-bit
User interaction: none; the script never prompts
Timeout: 30 minutes for large directories or many servers

Settings

Name	What it does	Options	Default
ComputerName	Servers to check. If empty, uses -SearchBase, or this computer.		(none)
SearchBase	OU (distinguished name) whose enabled servers are checked.
LogName	Logs to read. Default: System, Application. Others include Security and Directory Service.		System, Application
Level	Levels to include: Critical, Error, Warning. Default: Critical, Error.		Critical, Error
Hours	How far back to read. Default: 24.		24
MaxEvents	Most events to read per server and log. Default: 2000.		2000
AlertOn	Critical (default) exits 1 when any Critical event is found. Any exits 1 for any event found. Never always exits 0.	Critical, Any, Never	Critical
Server	Optional domain controller used to read the OU.

Exit codes

0 = Nothing that matches AlertOn
1 = Events found that match AlertOn, or some servers could not be read
2 = Script error (see log)

Testing steps

Run it on one test OU, test account or test server and check the output and log.
Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log

Version	Date	Changes
1.0.0	November 2026	First release.