Copy Windows Event Logs to Network Share
11/30/2017 1423 views
I am running an online Kscript to copy event logs to a network shared folder and I don't know why it is not working. I run the CMD script manually (run as different user) and I have no problems. This is the command in the CMD script:
xcopy %SystemRoot%\System32\Winevt\Logs\System.evtx \\172.##.##.##\eventlogs$ /Y /Q
I am running the script as saved credentials in kace which is a domain account with access to both the local files as well as the network share. During testing, I have opened full permissions to everyone so there should be no issue with permissions.
The KACE script logs do not provide any useful information because it basically says it ran successfully. However, it is saying 0 files copied. Not sure why since when I run it manually (run as the same account kace is using) the script runs successfully and copies the file.
C:\ProgramData\Dell\KACE\kbots_cache\packages\kbots\111>xcopy C:\WINDOWS\System32\Winevt\Logs\System.evtx \\172.##.##.##\eventlogs$ /Y /Q 0 File(s) copied
Answer Chosen by the Author
Please log in to answer
I actually found a much better solution to this:
I tried xcopy, copy and even Powershell's copy-item and none of them worked. However, wevtutil does the job perfectly!
Answered 12/01/2017 by: verasme