diff --git a/WEC-Setup.ps1 b/WEC-Setup.ps1 index ea5d92c..cec1d71 100644 --- a/WEC-Setup.ps1 +++ b/WEC-Setup.ps1 @@ -83,7 +83,23 @@ try { Write-Log "Configured WEF to forward events to localhost." $subscriptionName = "Security and PowerShell Events" - wecutil ds $subscriptionName 2>&1 + + # Check if subscription exists before attempting deletion + $existingSub = wecutil gs $subscriptionName 2>$null + if ($LASTEXITCODE -eq 0) { + Write-Log "Existing subscription '$subscriptionName' found. Attempting to delete..." + wecutil ds $subscriptionName 2>$null + if ($LASTEXITCODE -eq 0) { + Write-Log "Existing subscription '$subscriptionName' deleted successfully." + } else { + Write-Log "Failed to delete existing subscription '$subscriptionName'. Exit code: $LASTEXITCODE" + # Deletion failed, stop script. + throw "Failed to delete existing subscription '$subscriptionName'. Exit code: $LASTEXITCODE" + } + } else { + Write-Log "No existing subscription named '$subscriptionName' found. Skipping deletion." + } + $subscriptionXml = @" $subscriptionName