Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 10 | ForEach-Object { $x = [xml]$_.ToXml() [pscustomobject]@{ Time = $_.TimeCreated User = ($x.Event.EventData.Data | ? Name -eq 'TargetUserName').'#text' Domain = ($x.Event.EventData.Data | ? Name -eq 'TargetDomainName').'#text' Type = ($x.Event.EventData.Data | ? Name -eq 'LogonType').'#text' Status = ($x.Event.EventData.Data | ? Name -eq 'Status').'#text' Sub = ($x.Event.EventData.Data | ? Name -eq 'SubStatus').'#text' } } | Format-Table -Auto