function parse-12290($event) { $messagearray = $event.message.split(",") $pso = New-Object PSObject $pso | Add-Member NoteProperty "computername" $messagearray[2] $pso | Add-Member NoteProperty "computerid" $messagearray[3] $pso | Add-Member NoteProperty "timestamp" $messagearray[4] $pso | Add-Member NoteProperty "isvirtual" $messagearray[5] $pso | Add-Member NoteProperty "OOBStatus" $messagearray[6] $pso | Add-Member NoteProperty "OOBEexpirationinmin" $messagearray[7] Write-Output $pso } $event12290 = Get-WinEvent -LogName "Key Management Service" | where {$_.id -eq 12290} $computerliste = @{} foreach ($event in $event12290) { $result = parse-12290($event) if ($computerliste.containskey($result.computername)) { if ([datetime]$computerliste.item($result.computername).timestamp -le [datetime]$result.timestamp) { write-host "update Computer" $computerliste.item($result.computername) = $result } else { write-host "Skip old entry:" $result.computername } } else { write-host "New Computer found "$result.computername $computerliste.add($result.computername, $result) } } foreach ($key in $computerliste.keys){ write-host "Writing Record: $key" $computerliste.item($key) }