Skip to content

Improve Get-WinEvent -ListLog exception handling#27395

Merged
daxian-dbw merged 2 commits intoPowerShell:masterfrom
MartinGC94:WinEventErrorHandling
May 5, 2026
Merged

Improve Get-WinEvent -ListLog exception handling#27395
daxian-dbw merged 2 commits intoPowerShell:masterfrom
MartinGC94:WinEventErrorHandling

Conversation

@MartinGC94
Copy link
Copy Markdown
Contributor

PR Summary

This PR improves the error handling for Get-WinEvent -ListLog by adding a dedicated catch block for UnauthorizedAccessException exceptions and preventing an incorrect error message about not finding the specified log from showing up if the event log was found, but was inaccessible. See this before and after for the UX
Before:

PS C:\> Get-WinEvent -ListLog security
Get-WinEvent: To access the 'Security' log start PowerShell with elevated user rights.  Error: Attempted to perform an unauthorized operation.
Get-WinEvent: There is not an event log on the localhost computer that matches "security".
PS C:\>

After:

PS C:\> Get-WinEvent -listlog security
Get-WinEvent: Access denied for log: 'Security'.
  Recommendation: Launch PowerShell with elevated user rights.
PS C:\>

WriteObject was also moved outside of the try-catch to fix an issue where the PipelineStoppedException exception was being caught, which prevented Select -First X from working.

I haven't added any tests because I don't see what I'd need to test to avoid regressions here.

PR Context

Fixes: #27390

PR Checklist

Copilot AI review requested due to automatic review settings May 4, 2026 15:57
@MartinGC94 MartinGC94 requested a review from a team as a code owner May 4, 2026 15:57
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR improves Get-WinEvent -ListLog error handling by distinguishing access-denied failures from “log not found” scenarios and by avoiding catching PipelineStoppedException during output, improving UX and pipeline behavior.

Changes:

  • Add dedicated handling for UnauthorizedAccessException to emit a permission-denied error with a recommended action.
  • Move WriteObject outside the try/catch so Select-Object -First can stop the pipeline cleanly.
  • Add new localized resource strings for the new error message and recommendation text.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
src/Microsoft.PowerShell.Commands.Diagnostics/resources/GetEventResources.resx Adds new resource strings used for access-denied messaging and elevation recommendation.
src/Microsoft.PowerShell.Commands.Diagnostics/GetEventCommand.cs Updates ProcessListLog() to catch access-denied separately and avoid catching pipeline-stop exceptions during output.

logInfoObj = eventLogSession.GetLogInformation(logName, PathType.LogName);
}
catch (UnauthorizedAccessException exc)
{
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Certain log types are skipped so this cannot be moved to an earlier point.

Comment thread src/Microsoft.PowerShell.Commands.Diagnostics/GetEventCommand.cs Outdated
Comment on lines +258 to +262
<data name="LogInfoNoAccess" xml:space="preserve">
<value>Access denied for log: '{0}'.</value>
</data>
<data name="SuggestElevation" xml:space="preserve">
<value>Launch PowerShell with elevated user rights.</value>
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But what is the text file used for?

Comment on lines +574 to +576
outputObj.Properties.Add(new PSNoteProperty("RecordCount", logInfoObj.RecordCount));

WriteObject(outputObj);
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copy link
Copy Markdown
Member

@daxian-dbw daxian-dbw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks @MartinGC94!

@daxian-dbw daxian-dbw added the CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log label May 5, 2026
@daxian-dbw daxian-dbw merged commit 11eb374 into PowerShell:master May 5, 2026
35 of 37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Get-WinEvent -ListLog does not handle exceptions properly

3 participants