# Extract value from EventID

**URL:** <https://forums.powershell.org/t/extract-value-from-eventid/25943>\
**Category:** PowerShell Help\
**Created:** [June 19, 2025, 3:32am UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943 "2025-06-19T03:32:34Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![jenewa2508](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jenewa2508](https://forums.powershell.org/u/jenewa2508)\
**Post date:** [June 19, 2025, 3:32am UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/1 "2025-06-19T03:32:34Z")

</div>

```auto
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <EventID>4688</EventID>
    <Version>2</Version>
    <Level>0</Level>
    <Task>13312</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2025-06-19T01:17:24.768901400Z" />
    <EventRecordID>67601</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="12892" />
    <Channel>Security</Channel>
    <Computer>DESKTOP</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">DESKTOP$</Data>
    <Data Name="SubjectDomainName">WORKGROUP</Data>
    <Data Name="SubjectLogonId">0x3pa99</Data>
    <Data Name="NewProcessId">0x684</Data>
    <Data Name="NewProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="TokenElevationType">%%1936</Data>
    <Data Name="ProcessId">0xb34</Data>
    <Data Name="CommandLine">
    </Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">-</Data>
    <Data Name="TargetDomainName">-</Data>
    <Data Name="TargetLogonId">0x0</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\svchost.exe</Data>
    <Data Name="MandatoryLabel">S-1-16-16384</Data>
  </EventData>
</Event>

```

This is Event ID 4688. How do you directly extract the `0x3pa99` stored in the `Data` node with the `Name` attribute equal to `"SubjectLogonId"`. I was trying to use it with `Get-WinEvent -FilterXml $xpath` but I don’t know save the `0x3pa99` part as a variable to be used later on

```auto
$xpath = @"
    <QueryList>
  <Query Id="0">
    <Select Path="Security">*[System[(EventID=4688)]] and
    *[EventData[Data[@Name='SubjectLogonID'] and Data='0x3pa99']]
    </Select>
  </Query>
</QueryList>
"@

Get-WinEvent -FilterXml $xpath

```

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [June 19, 2025, 7:03am UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/2 "2025-06-19T07:03:55Z")

</div>

Would you like to give us a little more context?

You should treat such a post in a forum like you’d need to explain the issua to you grandma. ☝ 😉

Share the relevant code, error messages if you have some and your issue or what’s not working as expected.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![tonyd](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/tonyd/32/1041_2.png) [@tonyd](https://forums.powershell.org/u/tonyd)\
**Post date:** [June 19, 2025, 2:59pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/3 "2025-06-19T14:59:35Z")

</div>

> [@Olaf](#):
>
> Share the relevant code, error messages

As Olaf stated, more context would be nice. Here is a simple example to get the value, but again, more context is needed and this is not the only way.

```auto
[XML]$_.ToXml().SelectSingleNode("//*[@Name='SubjectLogonId']").InnerXml

```

In this case, I am piping the results of a Get-WinEvent through foreach-object, hence $\_. Lastly, I think this would have been a good question for AI.

---

<div class="post-metadata">

**Author:** ![vern\_anderson](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/vern_anderson/32/5140_2.png) [@vern\_anderson](https://forums.powershell.org/u/vern_anderson)\
**Post date:** [June 19, 2025, 3:28pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/4 "2025-06-19T15:28:49Z")

</div>

The EventLogEntry Object class in PowerShell has a very cool property named **ReplacementStrings**

Where you would index it. However, it’s hard for me to provide you with the correct code because I don’t have an example object in my event log. You would basically use whatever code you have that is capturing that exact event ID into a variable. Let’s say $MyEvent is your variable. Once you have it in the ISE or whatever where it stays in memory you would play around with the index number as follows.

```auto
$MyEVent.ReplacementStrings[0] and see if it contains the value "0x3pa99" then
$MyEVent.ReplacementStrings[1]
$MyEVent.ReplacementStrings[2] ## and so on until you find the "Index" of that string you are looking for.

```

Once you have it you would use normal string processing to remove the junk you didn’t want. for example. . .

`'<Data Name="SubjectLogonId">0x3pa99</Data>'.Split('>').Split('<')[2]`

But as the mighty admins have said we can’t really help you unless you share the code you have so far and what you have at least tried to do for yourself.

---

<div class="post-metadata">

**Author:** ![jenewa2508](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jenewa2508](https://forums.powershell.org/u/jenewa2508)\
**Post date:** [June 20, 2025, 1:40am UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/5 "2025-06-20T01:40:17Z")

</div>

i do not know how to go from here (question updated) 😬 😰

---

<div class="post-metadata">

**Author:** ![psdarwin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/psdarwin/32/2063_2.png) [@psdarwin](https://forums.powershell.org/u/psdarwin)\
**Post date:** [June 20, 2025, 1:26pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/6 "2025-06-20T13:26:05Z")

</div>

> [@jenewa2508](#):
>
> but I don’t know save the `0x3pa99` part as a variable to be used later on

Are you saying you want to have a variable that contains this value, or another similar value, to use in filtering? If that’s an accurate guess, try this:

```auto
$MyData = '0x3pa99'

$xpath = @"
    <QueryList>
  <Query Id="0">
    <Select Path="Security">*[System[(EventID=4688)]] and
    *[EventData[Data[@Name='SubjectLogonID'] and Data='$MyData']]
    </Select>
  </Query>
</QueryList>
"@

Get-WinEvent -FilterXml $xpath

```

---

<div class="post-metadata">

**Author:** ![psdarwin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/psdarwin/32/2063_2.png) [@psdarwin](https://forums.powershell.org/u/psdarwin)\
**Post date:** [June 20, 2025, 1:34pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/7 "2025-06-20T13:34:03Z")

</div>

More description of what you’re trying to accomplish would be really helpful. The big picture will give us context to understand what your goal is. Otherwise, we’re just guessing.

---

<div class="post-metadata">

**Author:** ![tonyd](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/tonyd/32/1041_2.png) [@tonyd](https://forums.powershell.org/u/tonyd)\
**Post date:** [June 20, 2025, 2:32pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/8 "2025-06-20T14:32:40Z")

</div>

> [@jenewa2508](#):
>
> i do not know how to go from here

And neither do we 🙂 … sorry, couldnt resist that.

So, 4688 is the event ID for process creation. Depending on your audit policy, you will get a ton of these. I suspect what you really want is a way to query for that Event ID, then extract the ‘SubjectLogonId’ results from that query? Is that an accurate statement?

If so … try this … XPath altered a bit to remove the system created process fluff …

```auto
$XPath = "Event[System[EventID=4688]] and Event[EventData[Data[@Name='SubjectUserSid'] != 'S-1-5-18']] and Event[EventData[Data[@Name='SubjectUserSid'] != 'S-1-5-19']]"
$logonIds = New-Object System.Collections.Generic.List[System.Object]

Get-WinEvent -FilterXpath $XPath | foreach-object {
      $logonIds.Add(([XML]$_.ToXml()).SelectSingleNode("//*[@Name='SubjectLogonId']").InnerXml)
}

```

Again, depending on your audit policy, you will get a TON of results in the $logonIds list.

---

<div class="post-metadata">

**Author:** ![jenewa2508](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jenewa2508](https://forums.powershell.org/u/jenewa2508)\
**Post date:** [June 20, 2025, 8:57pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/9 "2025-06-20T20:57:15Z")

</div>

```auto
$event = Get-winevent -filterhashtable @{logname='Security'; ID=4688}
$eventXml = [xml]$event.ToXml()
$eventxml.event.eventdata.data | where-object {$_.name -eq 'SubjectLogonId'}

```

```auto
Name #text  
---- -----  
SubjectLogonId 0x3pa99

```

I would like only output the #text part

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [June 20, 2025, 9:29pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/10 "2025-06-20T21:29:23Z")

</div>

… I’m still not sure if I get it … do you mean this:

```auto
$Eventxml.Event.EventData.Data | 
    Where-Object {$_.name -eq 'SubjectLogonId'} | 
        Select-Object -ExpandProperty '#text'

```

?? 🤔

---

<div class="post-metadata">

**Author:** ![jenewa2508](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jenewa2508](https://forums.powershell.org/u/jenewa2508)\
**Post date:** [June 20, 2025, 10:08pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/11 "2025-06-20T22:08:38Z")

</div>

```auto
Cannot convert value "System.Object[]" to type "System.Xml.XmlDocument". Error: "This document already has a 'DocumentElement' node."
At line:2 char:1
+ $eventXml = [xml]$event.ToXml()
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastToXmlDocument

```

This error came up

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [June 20, 2025, 10:20pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/12 "2025-06-20T22:20:07Z")

</div>

> [@jenewa2508](#):
>
> This error came up

And it didn’t come up before with the code you shared in your last reply? 🤔

> [@jenewa2508](#):
>
> `Cannot convert value "System.Object[]" to type "System.Xml.XmlDocument".`

You’ve got more than one result from your query … 🤷‍♂️ … so you have to use a loop …

```auto
$EventList = Get-WinEvent -FilterHashtable @{logname='Security'; ID=4688}
foreach ($EventItem in $EventList) {
    [xml]$eventXml = $EventItem.ToXml()
    $Eventxml.Event.EventData.Data | 
        Where-Object {$_.name -eq 'SubjectLogonId'} | 
            Select-Object -ExpandProperty '#text'
}

```

---

<div class="post-metadata">

**Author:** ![jenewa2508](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jenewa2508](https://forums.powershell.org/u/jenewa2508)\
**Post date:** [June 20, 2025, 10:53pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/13 "2025-06-20T22:53:46Z")

</div>

WOW, that did the trick, Thankyou very much

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [June 20, 2025, 11:04pm UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/14 "2025-06-20T23:04:20Z")

</div>

Do you ever answer questions?

---

<div class="post-metadata">

**Author:** ![jenewa2508](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jenewa2508](https://forums.powershell.org/u/jenewa2508)\
**Post date:** [June 21, 2025, 12:22am UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/15 "2025-06-21T00:22:03Z")

</div>

I have limited English. Please understand.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/1X/385e4f9fe133561ad30a814262fe0e0ae6bc3ef0.png) [@system](https://forums.powershell.org/u/system)\
**Post date:** [July 21, 2025, 12:22am UTC](https://forums.powershell.org/t/extract-value-from-eventid/25943/16 "2025-07-21T00:22:12Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.