MoOriginal

Thank you! So as from your original code they weren't in there to start with so should have been reported anyways? If that's right mine weren't being reported back hence my confusion

I have another question please. Got the non credential thing to work - so thanks I have tried adding some extra event codes to the application log read section specifically 18270 - to show sql differential backup changes and 18264 to show sql full backups. After adding though - these are still not being added to the generated csv file Im thought as you specify AND (type!='Information') and both the new event id's show as information they would ? Is there something im doing wrong? # Get the Application Log and export to CSV Get-WmiObject -ComputerName $computer ` -Query "SELECT ComputerName,Logfile,Type,TimeWritten,SourceName,Message,Category,EventCode,User ` FROM Win32_NTLogEvent WHERE (logfile='Application') AND (type!='Information') AND (EventCode!='1062') ` AND (EventCode!='9001') AND (EventCode!='1517') AND (EventCode!='18270') AND (EventCode!='18264') AND (EventCode!='16434') AND (EventCode!='16435') ` AND (EventCode!='30969') AND (EventCode!='1202') AND (EventCode!='1517') AND (EventCode!='257') ` AND (TimeWritten > '$BeginDate')" | ` SELECT ComputerName,Logfile,Type,@{name='TimeWritten';Expression={$_.ConvertToDateTime($_.TimeWritten)}},SourceName,Message,Category,EventCode,User | ` Export-Csv "$store\$computer-Application.csv"

Apologies as a noob powersheller - I dont have time to start at the beginning this is useful script and ive run this and it works great. However in order to run this as a SQL Scheduled task I can do myself call it from a bat file - but I was wondering how to get rid of the login prompt that would stop it running as a scheduled task Is it just a matter of removing all the the $user calls eg -Credential $user Thanks in advance