Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 10 |
ForEach-Object {
$x = [xml]$_.ToXml()
[pscustomobject]@{
Time = $_.TimeCreated
User = ($x.Event.EventData.Data | ? Name -eq 'TargetUserName').'#text'
Domain = ($x.Event.EventData.Data | ? Name -eq 'TargetDomainName').'#text'
Type = ($x.Event.EventData.Data | ? Name -eq 'LogonType').'#text'
Status = ($x.Event.EventData.Data | ? Name -eq 'Status').'#text'
Sub = ($x.Event.EventData.Data | ? Name -eq 'SubStatus').'#text'
}
} | Format-Table -Auto