Question

For this assignment, you will need any computer running PowerShell v5 or later. Your answer should only include the function or the script files that generate the results.

1. For this question, your challenge is to create a PowerShell function that accesses all the log files stored under C:\Windows\System32\winevt\Logs. The function should display only those event logs whose size is more than 1MB. Sort the result by LastWriteTime in descending order.

Answer 1

script.ps1
***********

$path = "C:\Windows\System32\winevt\Logs"
$destination = "C:\Users\Administrator\Desktop\output.txt"

$results = Get-ChildItem $path -Recurse | where {$_.extension -in ".evtx"} | Where-Object {$_.length/1MB -gt 1} | Select-Object Name, Extension, @{Name="Mbytes";Expression={ "{0:N0}" -f ($_.Length / 1mb) }}
$results | sort LastWriteTime -Descending | Out-File $destination

if you have any doubt then please ask me without any hesitation in the comment section below , if you like my answer then please thumbs up for the answer , before giving thumbs down please discuss the question it may possible that we may understand the question different way and we can edit and change the answers if you argue, thanks :)