From d83c782273d1acd3c66d18123bf0e2d6ae15e32e Mon Sep 17 00:00:00 2001 From: Joshua Moore <70028858+jlanemoore@users.noreply.github.com> Date: Wed, 15 Oct 2025 13:46:48 -0500 Subject: [PATCH] Search for existing subscriptions before attempting deletion Adds error handling to the script so that deletions are logged and if there isn't an existing subscription, no deletion occurs. Other failures should exit the script logging the failure in in the log file since the continued setup should fail if not done successfully. --- WEC-Setup.ps1 | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/WEC-Setup.ps1 b/WEC-Setup.ps1 index ea5d92c..cec1d71 100644 --- a/WEC-Setup.ps1 +++ b/WEC-Setup.ps1 @@ -83,7 +83,23 @@ try { Write-Log "Configured WEF to forward events to localhost." $subscriptionName = "Security and PowerShell Events" - wecutil ds $subscriptionName 2>&1 + + # Check if subscription exists before attempting deletion + $existingSub = wecutil gs $subscriptionName 2>$null + if ($LASTEXITCODE -eq 0) { + Write-Log "Existing subscription '$subscriptionName' found. Attempting to delete..." + wecutil ds $subscriptionName 2>$null + if ($LASTEXITCODE -eq 0) { + Write-Log "Existing subscription '$subscriptionName' deleted successfully." + } else { + Write-Log "Failed to delete existing subscription '$subscriptionName'. Exit code: $LASTEXITCODE" + # Deletion failed, stop script. + throw "Failed to delete existing subscription '$subscriptionName'. Exit code: $LASTEXITCODE" + } + } else { + Write-Log "No existing subscription named '$subscriptionName' found. Skipping deletion." + } + $subscriptionXml = @" $subscriptionName