Search for logon events in Security events using powershell
Revision as of 11:02, 8 September 2017 by Michael.mast (talk | contribs) (Created page with "<pre> Get-EventLog -LogName 'Security' -InstanceId 4624 | select timegenerated,@{Label="User";Expression={$_.replacementStrings[5]}},@{Label="Machine";Expression={$_.replaceme...")
Get-EventLog -LogName 'Security' -InstanceId 4624 | select timegenerated,@{Label="User";Expression={$_.replacementStrings[5]}},@{Label="Machine";Expression={$_.replacementStrings[18]}} | where {($_.User -notlike "*$*")
