PowerShell one-liner: Shadow Copy Backup date

Shadow Copy

This short article is about getting last Active Directory Shadow Copy Backup date. To check this we just have to scan event log for specific event id.

AD Backup

Information about Shadow Copy Backup is located in logname called ‘Directory Service’ and event id ‘1917’:

“The shadow copy backup for Active Directory Domain Services was successful.”

One of the command that we could use here is Get-WinEvent where we can specify some filters. More information about this command can be found on Microsoft docs.

#Locally
Get-WinEvent -FilterHashtable @{Logname='Directory Service';ID=1917}
Get-WinEvent -FilterHashtable @{Logname='Directory Service';ID=1917} | Out-GridView -Title "AD Backup"

#Remotely
Get-WinEvent -Computername DC01 -FilterHashtable @{Logname='Directory Service';ID=1917} | Out-GridView -Title "AD Backup"
Invoke-Command DC01 -ScriptBlock {Get-WinEvent -FilterHashtable @{Logname='Directory Service';ID=1917}} | Out-GridView -Title "AD Backup"

More examples for getting event log details can be found here – PowerShell one-liner: Get eventlog.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.