Привязать задачу к журналу событий Windows

Get-WinEvent -FilterHashTable @{logname = "Application"; ID=18264} -EA SilentlyContinue | select TimeCreated,Message

$event = Get-WinEvent -FilterHashTable @{logname = "Application"; ID=18264} -MaxEvents 1

if (-not ($Event = Get-WinEvent -MaxEvents 1 -FilterHashTable @{logname = "System"; ProviderName = 'Service Control Manager'; ID = 7036; Data = 'Print Spooler'})) {break}
if ($Event.Properties[1].Value -ne 'stopped') {break}
 
$SMTPServer   = "smtp.domain.ru"
$ComputerName = $env:COMPUTERNAME
$From         = "$ComputerName@domain.ru"
$To           = "my@domain.ru"
$Subj         = "$ComputerName - Alert"
$Body         = "Служба остановлена: "
$encoding     = [System.Text.Encoding]::UTF8
 
$Body += $Event.Properties[0].Value
$Body += "`r`n`r`n"
$Body += $Event.MachineName + "`r`n"
$Body += $Event.TimeCreated.ToString() + "`r`n"
$Body += $Event.Message
 
Send-MailMessage -Body $Body -From $From -SmtpServer $SMTPServer -To $To -Subject $Subj -Encoding  $encoding -Port 25

$Event = Get-WinEvent -MaxEvents 1 -FilterHashTable @{logname = "Application"; ProviderName = 'MSSQLSERVER'

$LOGQUERY=@"
<QueryList>
<Query Id="0" Path="System">
    <Select Path="System">* [System[EventID=7036]]</Select>
</Query>
</QueryList>
"@
$eventLogQuery=New-Object System.Diagnostics.Eventing.Reader.EventLogQuery("System",[System.Diagnostics.Eventing.Reader.PathType]::LogName,$LOGQUERY)
$eventViewer=New-Object System.Diagnostics.Eventing.Reader.EventLogWatcher($eventLogQuery)
$scriptblock=`
{
    $ENTRY=$event.SourceEventArgs
    $ENTRY.EventRecord|out-host
    $ENTRY.EventRecord.properties|out-host
}
Register-ObjectEvent -InputObject $eventViewer -EventName EventRecordWritten -Action $scriptblock
$eventViewer.Enabled=$true

$XmlQuery="<QueryList>
  <Query Id='0' Path='Security'>
    <Select Path='Application'>*[Provider[@Name='MSSQLSERVER'] and (EventID=18284) and (EventRecordID=$RecordID)]]</Select>
  </Query>
</QueryList>"
$Event = Get-WinEvent -FilterXml $XmlQuery

$XmlQuery = "<QueryList>
  <Query Id='0' Path='Application'>
    <Select Path='Application'>*[System[Provider[@Name='MSSQLSERVER'] and (EventRecordID = $RecordID) and (EventID = 18284)]]
    </Select>
  </Query>
</QueryList>"

[CmdletBinding()]
Param(
  [Parameter(Mandatory=$True,Position=1)]$RecordID,
  [Parameter(Mandatory=$True,Position=2)]$Channel
)
 
$XmlQuery = "<QueryList>
  <Query Id='0' Path='$Channel'>
    <Select Path='$Channel'>*[System[(EventRecordID = $RecordID)]]
    </Select>
  </Query>
</QueryList>"
 
$Event = Get-WinEvent -FilterXml $XmlQuery
 
if ($Event.Properties[0].Value -ne 'Print Spooler') {break}
if ($Event.Properties[1].Value -ne 'stopped')       {break}
 
# Нужная нам проверка события выполнена, далее выполняем требуемые действия
 
$Event.Id
$Event.TimeCreated
$Event.Message