Fixed windows event log check.

The output of the start/stop windows event log service was not correct. After checking the script on the sample file: disablestop-eventlog.evtx I have noticed that the output was not correct and found out it is actually the third parameter that should be checked instead of the second.
straysheep-dev · Nov 6, 2021 · ea97820 · ea97820
1 parent cf9411f
commit ea97820
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/DeepBlue.ps1 b/DeepBlue.ps1
@@ -391,7 +391,7 @@ function Main {
             ElseIf ($event.id -eq 7040){
                 # The start type of the Windows Event Log service was changed from auto start to disabled.
                 $servicename=$eventXML.Event.EventData.Data[0]."#text"
-                $action = $eventXML.Event.EventData.Data[1]."#text"
+                $action = $eventXML.Event.EventData.Data[2]."#text"
                 if ($servicename -ccontains "Windows Event Log") {
                     $obj.Results = "Service name: $servicename`n"
                     $obj.Results += $text