Win32_NTEventlogFile

$OverwriteOutDated_map = @{
Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events. = '0 (0x0)'
Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared. = '1 365'
No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared. = '4294967295 (0xFFFFFFFF)'
}

switch([int]$value)
{
  Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events. {'0 (0x0)'}
  Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared. {'1 365'}
  No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared. {'4294967295 (0xFFFFFFFF)'}
  default    {"$value"}
}

Enum EnumOverwriteOutDated
{
  _0_0x0                   = Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events.
  _1_365                   = Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared.
  _4294967295_0xFFFFFFFF   = No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared.
}

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "OverwriteOutDated" to friendly text

  Note: to use other properties than "OverwriteOutDated", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "OverwriteOutDated" 
# to translate other properties, use their translation table instead
$OverwriteOutDated_map = @{
Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events. = '0 (0x0)'
Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared. = '1 365'
No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared. = '4294967295 (0xFFFFFFFF)'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "OverwriteOutDated", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$OverwriteOutDated = @{
  Name = 'OverwriteOutDated'
  Expression = {
    # property is an array, so process all values
    $value = $_.OverwriteOutDated
    $OverwriteOutDated_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "OverwriteOutDated". The latter
# is defined by the hashtable in $OverwriteOutDated: 
Get-CimInstance -Class Win32_NTEventlogFile | Select-Object -Property Caption, $OverwriteOutDated

# ...or dump content of property OverwriteOutDated:
$friendlyValues = Get-CimInstance -Class Win32_NTEventlogFile | 
    Select-Object -Property $OverwriteOutDated |
    Select-Object -ExpandProperty OverwriteOutDated

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "Win32_NTEventlogFile" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "Win32_NTEventlogFile", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "Win32_NTEventlogFile" 
# to translate other properties, use their translation table instead
$OverwriteOutDated_map = @{
Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events. = '0 (0x0)'
Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared. = '1 365'
No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared. = '4294967295 (0xFFFFFFFF)'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class Win32_NTEventlogFile | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.OverwriteOutDated  

# translate raw value to friendly text:
$friendlyName = $OverwriteOutDated_map[[int]$rawValue]

# output value
$friendlyName

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "OverwriteOutDated" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "OverwriteOutDated", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "OverwriteOutDated", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$OverwriteOutDated = @{
  Name = 'OverwriteOutDated'
  Expression = {
    # property is an array, so process all values
    $value = $_.OverwriteOutDated
    
    switch([int]$value)
      {
        Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events. {'0 (0x0)'}
        Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared. {'1 365'}
        No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared. {'4294967295 (0xFFFFFFFF)'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName Win32_NTEventlogFile | 
  # ...and output properties "Caption" and "OverwriteOutDated". The latter is defined
  # by the hashtable in $OverwriteOutDated:
  Select-Object -Property Caption, $OverwriteOutDated

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "Win32_NTEventlogFile", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumOverwriteOutDated
{
  _0_0x0                   = Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events.
  _1_365                   = Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared.
  _4294967295_0xFFFFFFFF   = No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared.
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class Win32_NTEventlogFile | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.OverwriteOutDated

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **OverwriteOutDated** 
[EnumOverwriteOutDated]$rawValue 

# get a comma-separated string:
[EnumOverwriteOutDated]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumOverwriteOutDated]
#endregion

$OverWritePolicy_map = @{
The value of OverwriteOutDated equals 0 (zero). Any record can be overwritten to make room for new records. = 'WhenNeeded'
The value of OverwriteOutDated ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records. = 'OutDated'
The value of OverwriteOutDated equals 4294967295. Old records are never overwritten. = 'Never'
}

switch([int]$value)
{
  The value of OverwriteOutDated equals 0 (zero). Any record can be overwritten to make room for new records. {'WhenNeeded'}
  The value of OverwriteOutDated ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records. {'OutDated'}
  The value of OverwriteOutDated equals 4294967295. Old records are never overwritten. {'Never'}
  default    {"$value"}
}

Enum EnumOverWritePolicy
{
  WhenNeeded   = The value of OverwriteOutDated equals 0 (zero). Any record can be overwritten to make room for new records.
  OutDated     = The value of OverwriteOutDated ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records.
  Never        = The value of OverwriteOutDated equals 4294967295. Old records are never overwritten.
}

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "OverWritePolicy" to friendly text

  Note: to use other properties than "OverWritePolicy", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "OverWritePolicy" 
# to translate other properties, use their translation table instead
$OverWritePolicy_map = @{
The value of OverwriteOutDated equals 0 (zero). Any record can be overwritten to make room for new records. = 'WhenNeeded'
The value of OverwriteOutDated ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records. = 'OutDated'
The value of OverwriteOutDated equals 4294967295. Old records are never overwritten. = 'Never'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "OverWritePolicy", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$OverWritePolicy = @{
  Name = 'OverWritePolicy'
  Expression = {
    # property is an array, so process all values
    $value = $_.OverWritePolicy
    $OverWritePolicy_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "OverWritePolicy". The latter
# is defined by the hashtable in $OverWritePolicy: 
Get-CimInstance -Class Win32_NTEventlogFile | Select-Object -Property Caption, $OverWritePolicy

# ...or dump content of property OverWritePolicy:
$friendlyValues = Get-CimInstance -Class Win32_NTEventlogFile | 
    Select-Object -Property $OverWritePolicy |
    Select-Object -ExpandProperty OverWritePolicy

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "Win32_NTEventlogFile" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "Win32_NTEventlogFile", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "Win32_NTEventlogFile" 
# to translate other properties, use their translation table instead
$OverWritePolicy_map = @{
The value of OverwriteOutDated equals 0 (zero). Any record can be overwritten to make room for new records. = 'WhenNeeded'
The value of OverwriteOutDated ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records. = 'OutDated'
The value of OverwriteOutDated equals 4294967295. Old records are never overwritten. = 'Never'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class Win32_NTEventlogFile | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.OverWritePolicy  

# translate raw value to friendly text:
$friendlyName = $OverWritePolicy_map[[int]$rawValue]

# output value
$friendlyName

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "OverWritePolicy" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "OverWritePolicy", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "OverWritePolicy", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$OverWritePolicy = @{
  Name = 'OverWritePolicy'
  Expression = {
    # property is an array, so process all values
    $value = $_.OverWritePolicy
    
    switch([int]$value)
      {
        The value of OverwriteOutDated equals 0 (zero). Any record can be overwritten to make room for new records. {'WhenNeeded'}
        The value of OverwriteOutDated ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records. {'OutDated'}
        The value of OverwriteOutDated equals 4294967295. Old records are never overwritten. {'Never'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName Win32_NTEventlogFile | 
  # ...and output properties "Caption" and "OverWritePolicy". The latter is defined
  # by the hashtable in $OverWritePolicy:
  Select-Object -Property Caption, $OverWritePolicy

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "Win32_NTEventlogFile", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumOverWritePolicy
{
  WhenNeeded   = The value of OverwriteOutDated equals 0 (zero). Any record can be overwritten to make room for new records.
  OutDated     = The value of OverwriteOutDated ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records.
  Never        = The value of OverwriteOutDated equals 4294967295. Old records are never overwritten.
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class Win32_NTEventlogFile | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.OverWritePolicy

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **OverWritePolicy** 
[EnumOverWritePolicy]$rawValue 

# get a comma-separated string:
[EnumOverWritePolicy]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumOverWritePolicy]
#endregion

Get-CimInstance -ClassName Win32_NTEventlogFile

Get-CimInstance -ClassName Win32_NTEventlogFile -Property *

Get-CimInstance -ClassName Win32_NTEventlogFile -KeyOnly

$properties = 'AccessMask',
              'Archive',
              'Caption',
              'Compressed',
              'CompressionMethod',
              'CreationClassName',
              'CreationDate',
              'CSCreationClassName',
              'CSName',
              'Description',
              'Drive',
              'EightDotThreeFileName',
              'Encrypted',
              'EncryptionMethod',
              'Extension',
              'FileName',
              'FileSize',
              'FileType',
              'FSCreationClassName',
              'FSName',
              'Hidden',
              'InstallDate',
              'InUseCount',
              'LastAccessed',
              'LastModified',
              'LogfileName',
              'Manufacturer',
              'MaxFileSize',
              'Name',
              'NumberOfRecords',
              'OverwriteOutDated',
              'OverWritePolicy',
              'Path',
              'Readable',
              'Sources',
              'Status',
              'System',
              'Version',
              'Writeable'
Get-CimInstance -ClassName Win32_NTEventlogFile | Select-Object -Property $properties

Get-CimInstance -Class Win32_NTEventlogFile -Property $property | 
Select-Object -Property $property

Get-CimInstance -Class Win32_NTEventlogFile -Filter 'Caption LIKE "a%"' 

Get-CimInstance -Query "SELECT FSName, Readable, InUseCount, Caption FROM Win32_NTEventlogFile WHERE Caption LIKE 'a%'"

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with your current identity:
$result = Get-CimInstance -ClassName Win32_NTEventlogFile -ComputerName $list 
$result

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with a different identity:
$cred = Get-Credential -Message 'Authenticate to retrieve WMI information:'
$session = New-CimSession -ComputerName $list -Credential $cred

$result = Get-CimInstance Win32_NTEventlogFile -CimSession $session

# remove the session after use (if you do not plan to re-use it later)
Remove-CimSession -CimSession $session

$result