How to export Events from the InTrust Repository in the Windows Event Log format (EVT)? (4231091)

Sometime, there is a requirement to provide or store logs into the Windows Event Log format, can this be done from InTrust?

• InTrust contains a command line tool called ITEventExtractor.exe
• In order to use it, open an Elevated Command Prompt then navigate to

C:\Program Files (x86)\Common Files\Quest\InTrust (default path)

• Run the command as follow:

ITEventExtractor.exe /REPPATH:"C:\Program Files (x86)\Quest\InTrust\Server\InTrust\Repositories\default" /LOGNAME:Application /COMPUTER:"LABDC01" /DOMAIN:"QUESTLAB" /FILE:"C:\Temp\Application"  /DATEFROM:01/01/2019 /DATETO:03/11/2020

• Note that
  • The parts in Bold will need to be changed based on the environment and the double quotes are mandatory
  • /LOGNAME is required to define the type of Windows Log requested
  • /COMPUTER is the name of the target Host
  • /FILE is the path to store the EVT log
  • /DATEFROM and /DATETO define the interval for which to extract the logs
  • /DOMAIN is the Domain name but this can have been changed during the installation process so to make sure, please navigate to the Repository folder as shown in the example below:
• Repository path for computer LABDC01:

C:\Program Files (x86)\Quest\InTrust\Server\InTrust\Repositories\Default\Environment$\9E442BEE-EAC2-4D79-9013-053FB225CFD0$\Domain$\QUESTLAB$\Computer$\LA$\LABDC01$\DataSource$\{A9E5C7A2-5C01-41B7-9D36-E562DFDDEFA9}$\UnderDataSource$\Application$

• The Domain is mentioned after the Domain$/ so note the value and use it for the /DOMAIN switch and do not use the $ sign

• Note: If the DOMAIN is not properly provided the command will end with the following error:

< Nothing to process. >

• More switches can be found by typing 

ITEventExtractor.exe /help

• An Enhancement Request IN-12774 has been logged to provide a GUI interface to this functionality

Please check the Release Notes for more information