Use Windows Event Log to log events from PowerShell

Windows Event Log is a convenient event store to log information. Once data is in Windows Event log it can be correlated with other information on the system. 

There two basic steps to do this:

1. Create log location and source
2. Write log information into that location and source

To create log location and source, do:

PS C:\> New-EventLog -LogName 8thstring -Source 8thSource

Where:

8thstring is the log location

8thSource is the source

You have to run this on an elevated PowerShell session. And if you have Windows Event Viewer open, you have to close it and re-open to see the new log. This should show up under Applications and Service Logs. 

To write to that log location and source, do:

PS C:\> Write-EventLog -LogName 8thstring -Source 8thSource -Message "Hello world" -EventId 0 -EntryType information

Where:

-LogName 8thstring //8thstring was created using New-EventLog above

-Source 8thsource //8thSource was also created as part of New-EventLog call above

- Message "Hello world" //Message we wanted to write 

-EventId 0 //User defined ID assigned for this message

-EntryType information // Can be (information|warning|error)

Reference(s):

https://devblogs.microsoft.com/scripting/use-powershell-to-create-and-to-use-a-new-event-log/

Keywords:

PowerShell

Windows Eveng Log

How to install USB/IP for Windows on Server 2008 R2

USB/IP Project aims to develop a general USB device sharing system over IP network. To share USB devices between computers with their full functionality, USB/IP encapsulates "USB I/O messages" into TCP/IP payloads and transmits them between computers.

A fork of USB/IP client on Windows is located here. Getting this forked version to work with Windows Sever 2008 R2 is not straightforward. I have documented below how I was able to get it to work 2008 R2.

• Download 0.1.0 (https://github.com/cezanne/usbip-win/releases/tag/v0.1.0), download all into a directory excluding source*
• Remember to unblock the files
• Save to c:\usbip
• Download x64 build for Win7 (https://github.com/cezanne/usbip-win/files/4743857/usbip_vhci_v0.1.0_win7_x64.zip)
• Unblock the zip file
• Extract
• Copy the files and overwrite files in c:\usbip

Allow running non-validated driver

bcdedit.exe /set TESTSIGNING ON

Restart computer

Import certificates manually

• Run mmc.exe
• File | Add/Remove Snap-in…
• In Available snap-ins, select Certificates
• In This snap-in will always manage certificates for: select Computer account
• In This snap-in will always manage: radio options, select Local computer: (the computer this console is running on)
• Click on OK
• Navigate to Certificates (Local Computer) | Trusted Root Certification Authorities | Certificates
• Do Actions | All Tasks | Import…
• Click Next
• In File name: Browse to C:\usbip\usbip_test.pfx
• In Password: type usbip
• In Certificate Store select Place all certificates in the following store
• Click Next
• Click Finish
• Click OK
• Verify USBIP Test Certificate is added
• Next add the certificate into Trusted Publishers, Navigate to Certificates (Local Computer) | Trusted Publishers
• Repeat steps 8 to 16

Install driver manually

• Open cmd.exe to c:\usbip
• Run pnputil -i -a usbip_vhci.inf
• Add legacy device manually, run devmgmt.msc
• Select root item (ComputerName) Do Action | Add legacy hardware
• In Welcome to the Add Hardware Wizard, click Next
• In What do you want the wizard to do? select Install the hardware that I manually select from a list (Advanced) then click Next
• In Common hardware types: select Show All Devices and hit Next
• In Select the device driver you want to install for this hardware, click Have Disk…
• In Install from Disk browse to c:\usbip
• In Model select USB/IP VHCI and hit Next
• In Hardware to install: hit Next
• Wait and hit on Finish

To list devices that can be attached

usbip list -r <ip>

usbip list -r 192.168.1.2

To connect to specific USB device

usbip attach -r <ip> -b <bus id>

For example, to connect to a USB device on bus 5-1 (from the command above), do:

usbip attach -r 10.223.22.154 -b 5-1

Related issues:

https://github.com/cezanne/usbip-win/issues/154

Set IP address manually on Kali/Debian

sudo ip addr add 192.168.0.2/255.255.255.0 dev eth0

sudo ip link set dev eth0 up