Author Posts

August 29, 2017 at 7:31 pm

I am working on a script to measure the GPO's login duration using Event Log (5061)

$events = get-winevent -FilterHashTable @{LogName="Microsoft-Windows-GroupPolicy/Operational";ID=5016}
Foreach($event in $events){ .... }

I need to loop through each ID and get each GPO duration and then the total value for all.
Please Help

August 29, 2017 at 8:36 pm

I'm not sure how the event is formatted – does the event data contain a duration?

August 29, 2017 at 8:39 pm

I think you might need to get both Events 4016 and 5016 show the start and end of processing of groups of policies, including how long it took to apply each one in the end event. You'd get a DateWritten for each, and you'd need to calculate the difference. Unless 5016 does in fact have a duration, which you'd need to extract somehow.

But, if you get the duration, and you emit that as an object:

[pscustomobject]@{Duration=$whatever}

Then you can pipe your ForEach to Measure-Object and ask it to -Sum the -Property Duration for you.