title: get-wmiobject to pull logs using Win32_NTLogEvent
body: <p>I have to use get-wmiobject to pull logs off of a remote server. WinEvent doesn't work with 2003 servers and I'm getting blocked using eventlog. When I run the following command in powershell it works just fine, but when I send the output to a file I get completely different results and I'm not sure why?</p>
  
  <pre><code>Get-WmiObject -computername $server -query "SELECT * FROM Win32_NTLogEvent WHERE (logfile='system') AND (EventCode='19') AND (TimeWritten&gt;'$begindate')")
  </code></pre>
  
  <p>The output in powershell:</p>
  
  <pre><code>Category         : 8
  CategoryString   : Installation
  EventCode        : 19
  EventIdentifier  : 19
  TypeEvent        :
  InsertionStrings : {Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2836941)}
  LogFile          : System
  Message          : Installation Successful: Windows successfully installed the following update: Update for Microsoft .
                     NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2836941)
  </code></pre>
  
  <p>The output of the same command made into a variable and moved (<code>$x &gt; file.txt</code>) is completely different.</p>
  
  <pre><code>servername\root\cimv2:Win32_NTLogEvent.Logfile="System",RecordNumber=89477
  </code></pre>
  
  <p>Any ideas?</p>
  
  <p>Edit**</p>
  
  <pre><code>foreach($server in $servers) {
   $day = (Get-Date -UFormat %d)
   $hour = (Get-Date -UFormat %M)
   if ( $hour -lt "30") {
    $BeginDate=[System.Management.ManagementDateTimeConverter]::ToDMTFDateTime((get-date).AddDays(-30))
    $log = (Get-WmiObject -computername $server -query "SELECT * FROM Win32_NTLogEvent WHERE (logfile='system') AND (EventCode='19') AND (TimeWritten&gt;'$begindate')")
   }
   $FullLog += $server + '= [{ 
          "logfile":"' + $log + '"
          }]' + "`r`n"
  }
  Clear-Content UpdateLog.js
  $FullLog &gt; UpdateLog.js
  </code></pre>