Search code examples
windowspowershellevent-logpowershell-remoting

PowerShell remote event log clearing error: path to [computer] cannot be found


I am running a script that collects and clears event logs for every machine on a network. for some reason, when the script gets to the part where it needs to clear out the event logs for a workstation it throws an error saying "path to [computer] cannot be found". This network switched from a standard setup of several physical workstations connected to a network managed with VMware. it has a mix of virtual servers/workstations along with physical engineering workstations.

the script I'm using worked without issue when it was a more standard setup with no virtual workstations/servers.

all the servers & workstation names are stored in an array and called into the function "clear-eventlog -logname application, system, security -computername $var" with $var calling from the array of names.

I know the computers aren't misnamed in the array since it has no trouble pulling the audit logs from the workstations, and has no trouble clearing audit logs for the virtual servers.

It is only when it tries to clear the audit logs from the physical workstations that the error gets thrown, so i think it may be some sort of permission issue causing the audit logs to not be visible to the 'clear-eventlog' function but i have not been able to figure out how to get around it.

how do i get it to clear logs for the physical workstations?

#not exact, rewriting from memory
#skipping over most of the script, but this is the section thats throwing an error

@var = @(server1, server2, workstation1, workstation2, etc)

##issue with this part only when clearing physical workstation logs
clear-eventlog -LogName Application, Security, System, "Symantec Endpoint Protection Client" -computername $var

##error message
"path to [workstation name] cannot be found"

Solution

  • $computername = [computer1, computer2, etc]
    
    for ($i=0; $i -lt $computername.length; $i++){
    
    invoke-command -computerName $computername -scriptblock {clear-eventlog -logname application, security, system}
    
    }