View source for Search for logon events in Security events using powershell

<pre>
Get-EventLog -LogName 'Security' -InstanceId 4624 | select timegenerated,@{Label="User";Expression={$_.replacementStrings[5]}},@{Label="Machine";Expression={$_.replacementStrings[18]}} | where {($_.User -notlike "*$*")
</pre>
To search specific date ranges, add the following
<pre>
Get-EventLog -LogName 'Security' -InstanceId 4624 -After (date).AddDays(-1)...
</pre>