KMS Host - Event log search using powershell
With current situation regarding COVID, many companies have users with work laptops happily(?) working remotely. If devices rely on KMS for activation, many devices might suddenly be prompting users if they have not been able to check in for a while. You can search you KMS logs for activations (or not). You may be lucky and be able to go back pre-lockdown and pull out devices that initially connected but have'nt been seen since. In the KMS host, you can pull out the event logs and export to CSV. In this case we're looking at the Key Management Service logs and the ReplacementStrings result. item 7 of that array gives us the licence status of the machine as it attempts to activate. This can be one of: 0 - Unlicensed 1 - Licensed (Activated) 2 - OOB grace 3 - OOT grace, 4 - NonGenuineGrace 5 – Notifications 6 – Extended Grace A quick export into CSV and its ready to be sliced and diced in excel $now=get-date $startdate=$now.adddays(-210) $evtLog = get-eventlog -Comput