Run the Add-On with PowerShell

First, provide a path to your add-on followed by script parameters with their values. Each parameter is preceded with a dash; a space separates a parameter name from its value. You can skip some parameters— the script uses a default value unless you explicitly define it. If necessary, modify the parameters as required.

To run the add-on with PowerShell:

Step 1 – On computer where you want to execute the add-on, start Windows PowerShell.

Step 2 – Enter a path to the add-on, or drag and drop the add-on file into the console window.

Step 3 – Add script parameters. The console will look similar to the following:

Windows PowerShell

PS C:\Users\AddOnUser> C:\Add-ons\Netwrix_Auditor_CEF_Export_Add-on.ps1 -OutputFolder C:\CEF_Export -NetwrixAuditorHost 172.28.6.15

NOTE: If the script path contains spaces (e.g., C:\Netwrix Add-ons), enclose it in double quotes and insert the ampersand (&) symbol in front (e.g., & "C:\Netwrix Add-ons").

Step 4 – Press Enter.

Depending on the number of Activity Records stored in Auditor Audit Database, execution may take a while. Ensure the script execution completed successfully. The add-on creates the CEF log file in the destination folder.

note

Details (or "msg" in CEF terms) exceeding 16,000 characters are trimmed.

Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will start retrieving new Activity Records.