| Module | Severity | Issue |
|---|---|---|
| $($issue.Module) | $($issue.Severity) | $($issue.Issue) |
| Module | Priority | Recommendation |
|---|---|---|
| $($rec.Module) | $($rec.Priority) | $($rec.Recommendation) |
$($moduleData | ConvertTo-Json -Depth 3)
| Module | Action | Status | Details |
|---|---|---|---|
| $($rem.Module) | $($rem.Recommendation) | $($rem.Status) | $($rem.Details) |
| Check | Status | Required | Actual | Details | Remediation |
|---|---|---|---|---|---|
| $($result.Check) | $($result.Status) | $($result.Required) | $($result.Actual) | $($result.Details) | $(if ($result.Remediation) { $result.Remediation } else { 'N/A' }) |
✅ All prerequisites met. You can proceed with RDP diagnostics.
" } else { "⚠ Some prerequisites failed. Address the following before proceeding:
ℹ Warnings to consider:
Based on the diagnostic results, the following common issues were identified:
Total handshake steps monitored: $($handshake.TotalSteps)
Successful handshakes: $($handshake.SuccessfulHandshakes)
Failed handshakes: $($handshake.FailedHandshakes)
| Step | Time | Details |
|---|---|---|
| $($step.Step) | $($step.Time) | $($step.Details) |
No handshake events captured during monitoring period.
" })| Security Check | Status | Details |
|---|---|---|
| NLA Enabled | $(if ($sec.NLAEnabled) { '✅' } else { '❌' }) | $(if ($sec.NLAEnabled) { 'Enabled' } else { 'Disabled' }) |
| Certificate Valid | $(if (-not $sec.CertificateExpired) { '✅' } else { '❌' }) | $(if ($sec.CertificateExpired) { 'Expired: ' + $sec.CertificateExpiry } else { 'Valid' }) |
| Encryption Level | $(if ($sec.EncryptionLevel -ge 3) { '✅' } else { '⚠' }) | Level $($sec.EncryptionLevel) |
Based on the analysis, consider the following actions:
| Metric | Value | Status |
|---|---|---|
| Average RTT | $($analysis.AvgRTT) ms | $( if ($analysis.AvgRTT -lt 50) { "Good" } elseif ($analysis.AvgRTT -lt 100) { "Acceptable" } else { "Poor" } ) |
| Maximum RTT | $($analysis.MaxRTT) ms | $( if ($analysis.MaxRTT -lt 100) { "Good" } elseif ($analysis.MaxRTT -lt 200) { "Acceptable" } else { "Poor" } ) |
| Retransmissions | $($analysis.Retransmissions) | $( if ($analysis.Retransmissions -eq 0) { "Good" } elseif ($analysis.Retransmissions -lt 10) { "Acceptable" } else { "Poor" } ) |
| RDP Protocol Errors | $($analysis.RDPErrors) | $( if ($analysis.RDPErrors -eq 0) { "Good" } else { "Poor" } ) |
$($conversations | Out-String)
rdp.connect - Connection initiationrdp.error - Protocol errorstcp.analysis.retransmission - Packet retransmissionstcp.analysis.ack_rtt > 0.1 - High latency packetsrdp.channel - Virtual channel trafficVM Name: $($diagnosticResults.VMName)
Analysis Time: $($diagnosticResults.AnalysisTime)
$($diagnosticResults.RiskAssessment)
| Metric | Value |
|---|---|
| Total VRAM | $($diagnosticResults.TotalVRAM) |
| Used VRAM | $($diagnosticResults.UsedVRAM) |
| Free VRAM | $($diagnosticResults.FreeVRAM) |
| Fragmentation Level | $($diagnosticResults.FragmentationLevel)% |
| Counter | Instance | Value | Timestamp |
|---|---|---|---|
| $($metric.Counter) | $($metric.Instance) | $($metric.Value) | $($metric.Timestamp) |
Session: $SessionName
Report Time: $(Get-Date)
Total Alerts: $($Alerts.Count)
Critical Alerts: $($criticalAlerts.Count)
Warning Alerts: $($warningAlerts.Count)
No critical alerts
" })| Time | VM | Level | Metric | Value |
|---|---|---|---|---|
| $($_.AlertTime) | $($_.VMName) | $($_.AlertLevel) | $($_.Metric) | $($_.Value) |
| No alerts | ||||
This is an automated alert from RDSH Memory Health Monitoring System.
"@ # Note: In production, implement actual email sending logic # Send-MailMessage -To $EmailAddress -Subject $subject -Body $body -BodyAsHtml -SmtpServer "smtp.example.com" Write-Host "[EMAIL] Prepared alert email: $subject" -ForegroundColor Gray } function Invoke-WebhookAlert { param( [Parameter(Mandatory=$true)] [array]$Alerts, [Parameter(Mandatory=$true)] [string]$WebhookURL ) $criticalCount = ($Alerts | Where-Object { $_.AlertLevel -eq "CRITICAL" }).Count $warningCount = ($Alerts | Where-Object { $_.AlertLevel -eq "WARNING" }).Count $payload = @{ text = "RDSH Memory Health Alert: $criticalCount Critical, $warningCount Warning" attachments = @( @{ color = if ($criticalCount -gt 0) { "danger" } else { "warning" } fields = @( @{ title = "Critical Alerts" value = $criticalCount short = $true }, @{ title = "Warning Alerts" value = $warningCount short = $true }, @{ title = "Total Alerts" value = $Alerts.Count short = $true } ) } ) } # Note: In production, implement actual webhook call # Invoke-RestMethod -Uri $WebhookURL -Method Post -Body ($payload | ConvertTo-Json) -ContentType "application/json" Write-Host "[WEBHOOK] Prepared webhook alert" -ForegroundColor Gray } # Usage examples for comprehensive monitoring $monitoringSession = Monitor-RDSHMemoryHealth -VMNames "RDSH-VM01", "RDSH-VM02", "RDSH-VM03" ` -DurationMinutes 120 ` -CheckIntervalSeconds 60 ` -HighPressureThreshold 80 ` -CriticalPressureThreshold 90 ` -EnableRealTimeAlerts ` -GenerateTrendAnalysis ` -AlertEmail "admin@example.com" # Batch optimization with monitoring $optimizationReport = Optimize-HyperVRDSHMemory -VMNames "RDSH-VM01", "RDSH-VM02" ` -OptimizationProfile "Static" ` -StaticMemoryBytes 16GB ` -DisableSmartPaging ` -EnablePriorityBoost ` -GenerateValidationReport ` -MonitoringDurationMinutes 30 ``` #### 8.3.3 Performance Tuning Configuration Matrix The following table provides comprehensive configuration recommendations based on RDSH workload characteristics: | Workload Profile | Dynamic Memory | Startup Memory | Min Memory | Max Memory | Buffer % | Smart Paging | Memory Priority | Recommended For | |-----------------|----------------|----------------|------------|------------|----------|--------------|-----------------|-----------------| | **High Density** (30+ users) | Disabled | 16-24 GB | N/A | N/A | N/A | Disabled | Maximum | Call centers, task workers | | **Knowledge Workers** (15-30 users) | Conservative | 12-16 GB | 8 GB | 20 GB | 5% | Disabled | High | Office workers, mixed apps | | **Power Users** (5-15 users) | Balanced | 8-12 GB | 6 GB | 16 GB | 10% | Limited | Normal | Developers, designers | | **GPU-Intensive** (3-10 users) | Disabled | 16-32 GB | N/A | N/A | N/A | Disabled | Maximum | CAD, video editing | | **Test/Dev** | Aggressive | 4-8 GB | 2 GB | 12 GB | 20% | Enabled | Low | Development environments | **Configuration Formulas:** ``` For Static Allocation: Memory_Required = (Base_OS + (Users × Avg_User_Memory)) × Safety_Factor Where: Base_OS = 2-4 GB, Avg_User_Memory = 150-500 MB, Safety_Factor = 1.2-1.5 For Dynamic Memory: Startup = Memory_Required × 0.8 Minimum = Memory_Required × 0.6 Maximum = Memory_Required × 1.5 Buffer = 5-10% based on volatility Safety_Factor Adjustments: - Add 20% for unknown workloads - Add 30% for line-of-business applications - Add 50% for multimedia/content creation - Reduce 10% for well-characterized task workers ``` #### 8.3.4 Advanced Troubleshooting & Root Cause Analysis **Integrated Diagnostic Framework** ```powershell function Diagnose-RDSHMemoryIssues { param( [Parameter(Mandatory=$true)] [string]$VMName, [ValidateRange(1, 60)] [int]$AnalysisDurationMinutes = 15, [switch]$ComprehensiveAnalysis, [switch]$GenerateRemediationPlan, [switch]$MonitorInRealTime ) Write-Host "[RDSH MEMORY DIAGNOSTIC] Starting comprehensive analysis..." -ForegroundColor Cyan Write-Host "Target: $VMName | Duration: ${AnalysisDurationMinutes} minutes" -ForegroundColor White $diagnosticResults = @{ VMName = $VMName AnalysisStart = Get-Date IssuesDetected = @() PerformanceMetrics = @() ConfigurationAnalysis = @() EventLogFindings = @() Recommendations = @() RootCauseAnalysis = @() } # Phase 1: Configuration Analysis Write-Host "`n[PHASE 1] Configuration Analysis..." -ForegroundColor Yellow try { $vm = Get-VM -Name $VMName -ErrorAction Stop $memoryConfig = Get-VMMemory -VMName $VMName $configAnalysis = [PSCustomObject]@{ DynamicMemoryEnabled = $vm.DynamicMemoryEnabled MemoryAssigned = "$([math]::Round($vm.MemoryAssigned / 1GB, 2)) GB" MemoryDemand = "$([math]::Round($vm.MemoryDemand / 1GB, 2)) GB" StartupBytes = "$([math]::Round($memoryConfig.StartupBytes / 1GB, 2)) GB" MinimumBytes = "$([math]::Round($memoryConfig.MinimumBytes / 1GB, 2)) GB" MaximumBytes = "$([math]::Round($memoryConfig.MaximumBytes / 1GB, 2)) GB" BufferPercentage = "$($memoryConfig.MemoryBufferPercentage)%" SmartPagingEnabled = ($memoryConfig.MaximumBytes -lt $vm.MemoryDemand) NUMAConfiguration = if ($vm.NumaNodesPerSocket) { "Configured" } else { "Default" } } $diagnosticResults.ConfigurationAnalysis = $configAnalysis # Identify configuration issues if ($vm.DynamicMemoryEnabled -and $memoryConfig.MemoryBufferPercentage -gt 10) { $diagnosticResults.IssuesDetected += "High memory buffer ($($memoryConfig.MemoryBufferPercentage)%) may cause aggressive ballooning" $diagnosticResults.Recommendations += "Reduce memory buffer to 5% for RDSH workloads" } if ($configAnalysis.SmartPagingEnabled) { $diagnosticResults.IssuesDetected += "Smart Paging enabled - major performance impact for RDSH" $diagnosticResults.Recommendations += "Disable Smart Paging by setting MemoryMaximumPercentage to 100" } if ($vm.MemoryDemand -gt $vm.MemoryAssigned) { $pressure = [math]::Round(($vm.MemoryDemand / $vm.MemoryAssigned) * 100, 1) $diagnosticResults.IssuesDetected += "Memory pressure: ${pressure}% (demand exceeds assigned)" $diagnosticResults.Recommendations += "Increase memory allocation or reduce user load" } Write-Host " Configuration analysis complete" -ForegroundColor Green } catch { Write-Host " Configuration analysis failed: $_" -ForegroundColor Red $diagnosticResults.IssuesDetected += "Configuration analysis failed: $_" } # Phase 2: Performance Monitoring Write-Host "`n[PHASE 2] Performance Monitoring (${AnalysisDurationMinutes} minutes)..." -ForegroundColor Yellow if ($MonitorInRealTime -or $ComprehensiveAnalysis) { $monitoringEnd = (Get-Date).AddMinutes($AnalysisDurationMinutes) $sampleCount = 0 while ((Get-Date) -lt $monitoringEnd) { $sampleCount++ $timeRemaining = [math]::Round(($monitoringEnd - (Get-Date)).TotalMinutes, 1) Write-Progress -Activity "Performance Monitoring" ` -Status "Sample $sampleCount | Time remaining: ${timeRemaining} minutes" ` -PercentComplete (100 * ($AnalysisDurationMinutes - $timeRemaining) / $AnalysisDurationMinutes) try { $vm = Get-VM -Name $VMName -ErrorAction SilentlyContinue if ($vm) { $memory = Get-VMMemory -VMName $VMName # Collect performance counters $perfCounters = @( '\Memory\Available MBytes', '\Processor(_Total)\% Processor Time', '\Hyper-V Hypervisor Logical Processor(*)\% Total Run Time' ) $perfData = Get-Counter -Counter $perfCounters -ErrorAction SilentlyContinue $performancePoint = [PSCustomObject]@{ Sample = $sampleCount Timestamp = Get-Date MemoryAssignedGB = [math]::Round($vm.MemoryAssigned / 1GB, 3) MemoryDemandGB = [math]::Round($vm.MemoryDemand / 1GB, 3) MemoryPressure = if ($vm.MemoryAssigned -gt 0) { [math]::Round(($vm.MemoryDemand / $vm.MemoryAssigned) * 100, 1) } else { 0 } AvailableMemoryMB = if ($perfData) { ($perfData.CounterSamples | Where-Object { $_.Path -like '*Available MBytes*' }).CookedValue } else { $null } CPUUsage = if ($perfData) { ($perfData.CounterSamples | Where-Object { $_.Path -like '*% Processor Time*' }).CookedValue } else { $null } HypervisorLoad = if ($perfData) { ($perfData.CounterSamples | Where-Object { $_.Path -like '*% Total Run Time*' } | Measure-Object -Property CookedValue -Average).Average } else { $null } } $diagnosticResults.PerformanceMetrics += $performancePoint # Check for issues during monitoring if ($performancePoint.MemoryPressure -gt 90) { $diagnosticResults.IssuesDetected += "High memory pressure detected: $($performancePoint.MemoryPressure)% at sample $sampleCount" } if ($performancePoint.CPUUsage -gt 80) { $diagnosticResults.IssuesDetected += "High CPU usage: $($performancePoint.CPUUsage)% at sample $sampleCount" } } } catch { # Silently continue monitoring } Start-Sleep -Seconds 30 } Write-Progress -Activity "Performance Monitoring" -Completed Write-Host " Collected $sampleCount performance samples" -ForegroundColor Green } # Phase 3: Event Log Analysis Write-Host "`n[PHASE 3] Event Log Analysis..." -ForegroundColor Yellow try { # Check Hyper-V specific events $hypervEvents = Get-WinEvent -LogName "Microsoft-Windows-Hyper-V-Worker/Diagnostic" -MaxEvents 50 -ErrorAction SilentlyContinue | Where-Object { $_.Message -like "*memory*" -or $_.Message -like "*balloon*" -or $_.Message -like "*paging*" } | Select-Object TimeCreated, LevelDisplayName, Id, Message | Sort-Object TimeCreated -Descending # Check System events $systemEvents = Get-WinEvent -LogName "System" -MaxEvents 100 -ErrorAction SilentlyContinue | Where-Object { $_.Id -in @(1, 2004, 2005, 2010, 2011) -or $_.Message -like "*memory*" -or $_.Message -like "*pool*" } | Select-Object TimeCreated, LevelDisplayName, Id, ProviderName, Message | Sort-Object TimeCreated -Descending $diagnosticResults.EventLogFindings = @{ HyperVEvents = $hypervEvents SystemEvents = $systemEvents TotalEventsAnalyzed = $hypervEvents.Count + $systemEvents.Count } # Analyze event patterns $balloonEvents = $hypervEvents | Where-Object { $_.Message -like "*balloon*" } $pagingEvents = $systemEvents | Where-Object { $_.Message -like "*paging*" -or $_.Message -like "*pagefile*" } if ($balloonEvents.Count -gt 5) { $diagnosticResults.IssuesDetected += "Frequent balloon driver activity detected ($($balloonEvents.Count) events)" $diagnosticResults.Recommendations += "Consider disabling Dynamic Memory for this RDSH workload" } if ($pagingEvents.Count -gt 3) { $diagnosticResults.IssuesDetected += "Paging activity detected ($($pagingEvents.Count) events)" $diagnosticResults.Recommendations += "Increase memory allocation or reduce workload" } Write-Host " Analyzed $($diagnosticResults.EventLogFindings.TotalEventsAnalyzed) relevant events" -ForegroundColor Green } catch { Write-Host " Event log analysis failed: $_" -ForegroundColor Red } # Phase 4: Root Cause Analysis Write-Host "`n[PHASE 4] Root Cause Analysis..." -ForegroundColor Yellow if ($diagnosticResults.IssuesDetected.Count -gt 0) { # Categorize issues $memoryPressureIssues = $diagnosticResults.IssuesDetected | Where-Object { $_ -like "*pressure*" } $configurationIssues = $diagnosticResults.IssuesDetected | Where-Object { $_ -like "*buffer*" -or $_ -like "*Smart Paging*" } $performanceIssues = $diagnosticResults.IssuesDetected | Where-Object { $_ -like "*CPU*" -or $_ -like "*balloon*" } # Determine primary root cause if ($memoryPressureIssues.Count -gt 0) { $diagnosticResults.RootCauseAnalysis += "Primary: Insufficient memory allocation for RDSH workload" $diagnosticResults.RootCauseAnalysis += "Contributing: High user load or memory-intensive applications" } if ($configurationIssues.Count -gt 0) { $diagnosticResults.RootCauseAnalysis += "Primary: Suboptimal Hyper-V memory configuration" $diagnosticResults.RootCauseAnalysis += "Contributing: Dynamic Memory settings not optimized for RDSH" } if ($performanceIssues.Count -gt 0 -and $memoryPressureIssues.Count -eq 0) { $diagnosticResults.RootCauseAnalysis += "Primary: CPU contention or hypervisor overhead" $diagnosticResults.RootCauseAnalysis += "Contributing: Host resource constraints" } # Generate severity assessment $criticalIssues = $diagnosticResults.IssuesDetected | Where-Object { $_ -like "*critical*" -or $_ -like "*severe*" -or $_ -like "*Smart Paging*" } if ($criticalIssues.Count -gt 0) { $diagnosticResults.RootCauseAnalysis += "Severity: CRITICAL - Immediate action required" } elseif ($diagnosticResults.IssuesDetected.Count -gt 3) { $diagnosticResults.RootCauseAnalysis += "Severity: HIGH - Significant performance impact" } elseif ($diagnosticResults.IssuesDetected.Count -gt 0) { $diagnosticResults.RootCauseAnalysis += "Severity: MEDIUM - Optimization recommended" } else { $diagnosticResults.RootCauseAnalysis += "Severity: LOW - No critical issues detected" } } else { $diagnosticResults.RootCauseAnalysis += "No significant issues detected in configuration or performance data" $diagnosticResults.RootCauseAnalysis += "Current memory configuration appears appropriate for workload" } # Phase 5: Generate Remediation Plan if ($GenerateRemediationPlan) { Write-Host "`n[PHASE 5] Generating Remediation Plan..." -ForegroundColor Green $remediationSteps = @() # Immediate actions (if critical issues) $criticalIssues = $diagnosticResults.IssuesDetected | Where-Object { $_ -like "*Smart Paging*" -or $_ -like "*pressure*90*" } if ($criticalIssues.Count -gt 0) { $remediationSteps += @{ Priority = "IMMEDIATE" Actions = @( "Disable Smart Paging: Set-VM -VMName $VMName -MemoryMaximumPercentage 100", "Increase memory allocation by 25% immediately", "Restart VM to clear memory pressure" ) ExpectedImpact = "Eliminate disk paging and reduce memory pressure" } } # Short-term optimizations $configIssues = $diagnosticResults.ConfigurationAnalysis if ($configIssues.DynamicMemoryEnabled -eq $true) { $remediationSteps += @{ Priority = "SHORT-TERM" Actions = @( "Switch to static memory: Set-VM -VMName $VMName -DynamicMemory `$false", "Set appropriate static memory: Set-VM -VMName $VMName -MemoryStartupBytes 12GB", "Disable Dynamic Memory balloon driver" ) ExpectedImpact = "Eliminate balloon driver overhead and stabilize memory" } } # Long-term recommendations $remediationSteps += @{ Priority = "LONG-TERM" Actions = @( "Implement continuous monitoring with Monitor-RDSHMemoryHealth", "Establish baseline performance metrics", "Consider host-level memory optimization", "Evaluate application memory usage patterns" ) ExpectedImpact = "Proactive management and capacity planning" } $diagnosticResults.RemediationPlan = $remediationSteps } # Finalize diagnostic results $diagnosticResults.AnalysisEnd = Get-Date $diagnosticResults.AnalysisDuration = [math]::Round(($diagnosticResults.AnalysisEnd - $diagnosticResults.AnalysisStart).TotalMinutes, 1) # Generate summary report Write-Host "`n" + ("="*80) -ForegroundColor Cyan Write-Host "RDSH MEMORY DIAGNOSTIC COMPLETE" -ForegroundColor Cyan Write-Host ("="*80) -ForegroundColor Cyan Write-Host "VM Name: $VMName" -ForegroundColor White Write-Host "Analysis Duration: $($diagnosticResults.AnalysisDuration) minutes" -ForegroundColor White Write-Host "Issues Detected: $($diagnosticResults.IssuesDetected.Count)" -ForegroundColor $(if ($diagnosticResults.IssuesDetected.Count -gt 0) { "Red" } else { "Green" }) if ($diagnosticResults.RootCauseAnalysis.Count -gt 0) { Write-Host "`nRoot Cause Analysis:" -ForegroundColor Yellow foreach ($rca in $diagnosticResults.RootCauseAnalysis) { Write-Host " • $rca" -ForegroundColor White } } if ($diagnosticResults.Recommendations.Count -gt 0) { Write-Host "`nKey Recommendations:" -ForegroundColor Green foreach ($recommendation in $diagnosticResults.Recommendations) { Write-Host " • $recommendation" -ForegroundColor White } } # Save diagnostic report $reportDir = "C:\Diagnostics\RDSH_Memory\$VMName\$(Get-Date -Format 'yyyyMMdd_HHmmss')" New-Item -ItemType Directory -Path $reportDir -Force | Out-Null $reportPath = "$reportDir\Diagnostic_Report.json" $diagnosticResults | ConvertTo-Json -Depth 5 | Out-File -FilePath $reportPath -Encoding UTF8 if ($diagnosticResults.PerformanceMetrics.Count -gt 0) { $performancePath = "$reportDir\Performance_Metrics.csv" $diagnosticResults.PerformanceMetrics | Export-Csv -Path $performancePath -NoTypeInformation } Write-Host "`nDetailed report saved to: $reportDir" -ForegroundColor Green return [PSCustomObject]$diagnosticResults } # Usage examples for comprehensive diagnostics $diagnosticResult = Diagnose-RDSHMemoryIssues -VMName "RDSH-VM01" ` -AnalysisDurationMinutes 20 ` -ComprehensiveAnalysis ` -GenerateRemediationPlan ` -MonitorInRealTime # Batch diagnostics for multiple VMs $problemVMs = @("RDSH-VM01", "RDSH-VM02", "RDSH-VM03") $allDiagnostics = @() foreach ($vm in $problemVMs) { Write-Host "`nDiagnosing $vm..." -ForegroundColor Cyan $diagnosis = Diagnose-RDSHMemoryIssues -VMName $vm -AnalysisDurationMinutes 10 $allDiagnostics += $diagnosis } # Identify VMs with critical issues $criticalVMs = $allDiagnostics | Where-Object { $_.RootCauseAnalysis -like "*CRITICAL*" -or $_.IssuesDetected.Count -gt 5 } | Select-Object -ExpandProperty VMName if ($criticalVMs.Count -gt 0) { Write-Host "`n[ALERT] Critical issues detected in: $($criticalVMs -join ', ')" -ForegroundColor Red } ``` --- ### 8.3.5 Enterprise Deployment Guidelines & Best Practices **Architectural Decision Framework** ```mermaid flowchart TD subgraph Assessment["Workload Assessment Phase"] A1[User Count & Profile Analysis] A2[Application Memory Requirements] A3[Performance SLAs & Objectives] A4[Growth Projections] end subgraph Architecture["Architecture Selection"] B1{Primary Use Case?} B1 --> B2[High DensityReport Date: $(Get-Date)
Monitoring Period: $StartTime to $EndTime
Computers Monitored: $($ComputerNames.Count)
Total Events: $($complianceData.Count)
Blocked Executions: $($violations.Count)
Compliance Score: $([math]::Round((1 - ($violations.Count / [math]::Max($complianceData.Count, 1))) * 100, 2))%
| Computer | Time | Severity | Process | File Path | Policy ID |
|---|---|---|---|---|---|
| $($violation.ComputerName) | $($violation.Timestamp) | $($violation.Severity) | $($violation.Process) | $($violation.FilePath) | $($violation.PolicyId) |
No security violations detected during monitoring period.
" })| Computer | Time | Event ID | Enforcement | Process | File Path |
|---|---|---|---|---|---|
| $($event.ComputerName) | $($event.TimeCreated) | $($event.EventId) | $($event.Enforcement) | $($event.ProcessName) | $($event.FilePath) |