PowerShell脚本用>>重定向输出报错：'>>'未被识别的原因

问题描述 #

编写了一段获取Windows安全日志登录事件的PowerShell脚本，尝试用>>将输出追加到D:\test.txt时触发报错，提示'>>'未被识别为cmdlet、函数、脚本文件或可运行程序。

脚本内容 #

# Define time for report (default is 10 day)
$startDate = (get-date).AddDays(-10)

# Store successful logon events from security logs with the specified dates and workstation/IP in an array

$slogonevents = Get-Eventlog -LogName Security -after $startDate | where {$_.eventID -eq 4624 }

# Crawl through events; print all logon history with type, date/time, status, account name, computer and IP address if user logged on remotely

  foreach ($e in $slogonevents){
    # Logon Successful Events
    # Local (Logon Type 2)
    if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 2)){
      write-host "Type: Local Logon`tDate: "$e.TimeGenerated "`tStatus: Success`tUser: "$e.ReplacementStrings[5] "`tWorkstation: "$e.ReplacementStrings[11]
    }
    # Remote (Logon Type 10)
    if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 10)){
      write-host "Type: Remote Logon`tDate: "$e.TimeGenerated "`tStatus: Success`tUser: "$e.ReplacementStrings[5] "`tWorkstation: "$e.ReplacementStrings[11] "`tIP Address: "$e.ReplacementStrings[18]
    }
} >> D:\test.txt

报错信息 #

>> : The term '>>' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and 
try again.
At D:\Cyber_security\Python\Untitled1.ps1:26 char:3
+ } >> D:\test.txt
+   ~~
    + CategoryInfo          : ObjectNotFound: (>>:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

报错原因 #

1. 重定向符号放置位置错误：>>是PowerShell控制台的重定向操作符，但不能直接写在脚本中foreach循环的闭合括号后。PowerShell脚本语法不支持在代码块末尾直接附加重定向符号。
2. 输出流问题：脚本使用Write-Host输出内容，这个cmdlet的输出直接发送到控制台，不会进入PowerShell的标准输出流——就算重定向语法正确，也无法将Write-Host的内容写入文件（PowerShell 5.1+可通过修改配置实现，但并非常规用法）。

解决方法 #

方法1：包裹代码块并重定向输出 #

将foreach循环包裹在脚本块中，对整个块的输出进行重定向，同时把Write-Host替换为直接输出字符串（PowerShell默认会将未赋值的字符串送入标准输出流）：

# Define time for report (default is 10 day)
$startDate = (get-date).AddDays(-10)

# Store successful logon events from security logs with the specified dates and workstation/IP in an array

$slogonevents = Get-Eventlog -LogName Security -after $startDate | where {$_.eventID -eq 4624 }

# Crawl through events; print all logon history with type, date/time, status, account name, computer and IP address if user logged on remotely

& {
  foreach ($e in $slogonevents){
    # Logon Successful Events
    # Local (Logon Type 2)
    if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 2)){
      "Type: Local Logon`tDate: $($e.TimeGenerated)`tStatus: Success`tUser: $($e.ReplacementStrings[5])`tWorkstation: $($e.ReplacementStrings[11])"
    }
    # Remote (Logon Type 10)
    if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 10)){
      "Type: Remote Logon`tDate: $($e.TimeGenerated)`tStatus: Success`tUser: $($e.ReplacementStrings[5])`tWorkstation: $($e.ReplacementStrings[11])`tIP Address: $($e.ReplacementStrings[18])"
    }
  }
} >> D:\test.txt

方法2：使用Add-Content直接追加文件 #

用PowerShell原生的Add-Content cmdlet在循环内部直接将内容追加到文件，无需依赖重定向操作符，更符合PowerShell的使用习惯：

# Define time for report (default is 10 day)
$startDate = (get-date).AddDays(-10)

# Store successful logon events from security logs with the specified dates and workstation/IP in an array

$slogonevents = Get-Eventlog -LogName Security -after $startDate | where {$_.eventID -eq 4624 }

# Crawl through events; print all logon history with type, date/time, status, account name, computer and IP address if user logged on remotely

foreach ($e in $slogonevents){
  # Logon Successful Events
  # Local (Logon Type 2)
  if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 2)){
    $line = "Type: Local Logon`tDate: $($e.TimeGenerated)`tStatus: Success`tUser: $($e.ReplacementStrings[5])`tWorkstation: $($e.ReplacementStrings[11])"
    Add-Content -Path D:\test.txt -Value $line
  }
  # Remote (Logon Type 10)
  if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 10)){
    $line = "Type: Remote Logon`tDate: $($e.TimeGenerated)`tStatus: Success`tUser: $($e.ReplacementStrings[5])`tWorkstation: $($e.ReplacementStrings[11])`tIP Address: $($e.ReplacementStrings[18])"
    Add-Content -Path D:\test.txt -Value $line
  }
}

内容的提问来源于stack exchange，提问作者ijahan