0

The security patches released by Microsoft a few days ago can cause some Bluetooth devices to stop working. The release notes explain how to check whether we will be affected: we have to check the event log, and if we find certain events, then we are affected.

These are the things to look for:

Event Log: System
Event Source: BTHUSB or BTHMINI
Event ID: 22
Name: BTHPORT_DEBUG_LINK_KEY_NOT_ALLOWED
Level: Error
Event Message Text: Your Bluetooth device attempted to establish a debug connection. The Windows Bluetooth stack does not allow debug connection while it is not in the debug mode.

I'm not very familiar with the Windows Event Viewer, and right now it isn't even working, due to another bug (yay!).

So I'm trying to write a Powershell script, but I'm having a lot of trouble. First I tried using Get-EventLog, but I read it's outdated, and I should use Get-WinEvent. Either way, I'm stuck, because I expect to find some options to filter the output based on the criteria in the release notes, but I can't find the right arguments. What I've come up with is (according to the docs, 'Error' corresponds to level 2):

Get-WinEvent -FilterHashtable @{
    Logname='System'
    ProviderName='BTHUSB','BTHMINI'
    Id=22
    Level=2
}

which gives an ugly error, whereas by changing the values of Id and Level it works, so I think my syntax is fine, and all of this probably means I won't be affected. Great.

Still, I don't understand how I could filter precisely for the name and message text. Can anyone tell me how to map them to some options in the filter? For example, I've already found that "Event Log" is mapped to "Logname", and "Event Source" to "ProviderName". What do I have to use for Name and Message Text?

2
  • @Biswapriyo No. The only thing I have that might be somehow related is Visual Studio 2017, but that's it. Commented Jun 16, 2019 at 21:27
  • @Biswapriyo Yes, I do! Under bin I have several folders, that is: 10.0.14393.0, 10.0.15063.0, 10.0.16299.0, 10.0.17134.0, 10.0.17763.0, arm, arm64, x64, x86. Inside the 10.0.xyz folders I have both x86 and x64, and in most cases also arm, arm64 and XamlCompiler. But before you waste too much time on this, let me say that if this could lead to an alternative solution it would be great, but what I'm looking for is a way to map those "fields" to the corresponding arguments in Powershell. Commented Jun 17, 2019 at 23:09

1 Answer 1

0

You might find Nirsoft's FullEventLogView more convenient than PowerShell, particularly because Windows 10 v. 1903 crashes the Event Log Viewer. Though MS has released a partial fix, The free Nirsoft tool also offers capabilities in addition to those of the MS log viewer, such as searching.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .