Windows 10: Using Write-Eventlog for remote event log returns OSWritingError

I have a powershell script that works on Windows 7 with powershell versions 3, 4, and 5. The same script ran on Windows 10 the command gives me a OSWriting error:

PS C:\WINDOWS\system32> Write-EventLog -LogName ClearLoftwareLabels2 -Source Scripts2 -ComputerName COMDCLKD01 -EventId 1 -Message Test


Write-EventLog : The operating system reported an error when writing the event entry to the event log. A Windows error code is not

available.

At line:1 char:1

+ Write-EventLog -LogName ClearLoftwareLabels2 -Source Scripts2 -Comput ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : WriteError: ) [Write-EventLog], Exception

+ FullyQualifiedErrorId : OSWritingError,Microsoft.PowerShell.Commands.WriteEventLogCommand


The command is writing to a Windows 12 server with a custom log file. The Windows 7 users have been using this for several months with out issue. We are starting to roll out Windows 10 and we are seeing this.

I have read plenty of blogs and various articles with no success at finding information around Windows 10 and security to remote event logs.


The full command is:

Write-EventLog-LogNameClearRunAwayLabels-SourceScripts-Message"This entry will cause a scheduled task to run for clearing print jobs."-EventId3-EntryTypeInformation-ComputerName ???????

Looking for ideas or solution to why I am getting a write error, if the account or command can not access the reg to find the eventlog another error would appear, therefore it found the log but can not write. From Win 10 I can issue Get-Eventlog and read the entries.



:)

 

Event 3104 Search: "Enumerating user sessions to generate filter pools failed"

With respect to the BSOD have you the eventlog message that occurred - in most BSOD now, Microsoft is writing the issue to the Event Viewer Log (I seem to recall it was the System log)

In my cases to date the 3104 issue does not appear to be related to BSODs

 

Event Error Log

PS C:\WINDOWS\system32> remove-EventLog -Source "Custom Log"

remove-EventLog : The source name "Custom Log" does not exist on computer "localhost".

At line:1 char:1

+ remove-EventLog -Source "Custom Log"

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: ) [Remove-EventLog], InvalidOperationException

+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.RemoveEventLogCommand



PS C:\WINDOWS\system32> remove-EventLog -Source "CMS Application Log"

remove-EventLog : The event log source 'CMS Application Log' cannot be deleted, because it's equal to the log name.

At line:1 char:1

+ remove-EventLog -Source "CMS Application Log"

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : NotSpecified: ) [Remove-EventLog], InvalidOperationException

+ FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.RemoveEventLogCommand



PS C:\WINDOWS\system32>