• Hi Roy, thanks for the feedback.
    Yes that is also a way to retrieve the information.
    I think it is depending on a the amount of data that is in the EventLog.
    Just did a little test and there was no difference in the timing.

  • Roy Essers

    Great script, I use a similar script to perform some login actions depending on publishing refresh. But why do you not use a FilterHashTable to retrieve the 19001 and 19002 events, this is much faster then a where/select loop, like:
    Get-WinEvent -FilterHashTable @{LogName = “Microsoft-AppV-Client/Operational” ; ID=19001 } -MaxEvents 1