So I posted this https://blog.flaphead.com/2013/03/13/get-a-list-of-insite-dcs-from-eventlog/ a month or so ago, and found some stuff in that didn’t quite work for me.
So here is the update code. Essentially I have now split out the server and domain so they can be referenced in the array
$Evt2080 = Get-EventLog Application -Source “MSExchange ADAccess” | where {($_.Category -eq “Topology”) -AND ($_.EventId -eq 2080)} | Select -first 1
$InSiteMatrix = @()
$Fields = “Server”,”Roles”, “Enabled”, “Reachability”, “Synchronized”, “GCcapable”, “PDC”, “SACLright”, “CriticalData”, “Netlogon”, “OSVersion”, “HostName”, “Domain”
$InSite = ($Evt2080.ReplacementStrings[-2]).Split(“`n”) | Where {$_}
ForEach($Item in $InSite){
$tmpMatrix = “” | Select $Fields
$tmpSplit = $item.Split(“`t”)
$tmpMatrix.Server = $tmpSplit[0]
$tmpMatrix.HostName = $tmpMatrix.Server.Split(“.”)[0]
$tmpMatrix.Domain = $tmpMatrix.Server.Substring($tmpMatrix.HostName.Length +1)
If($tmpMatrix.Server -ne “”){
$i=1
$tmpValues = $tmpSplit[-1].split(” “)
ForEach($thing in $tmpValues ){
$tmpMatrix.($Fields[$i]) = $thing
$i++
} #ForEach
$InSiteMatrix += $tmpMatrix
} #If
} #ForEach
flaphead.com 