If I try to find when the user abc.cd logon to my computer.
I will do a log query as follow.
Get-WinEvent -FilterHashtable @{logname=‘security’;data=‘abc.cd’;id=4624}
If I want to know when a software was install on computer.
I will do a log query as follow.
Get-WinEvent -FilterHashtable @{logname=‘application’;id=11707}
but It does not work with a user ID as follow.
Get-WinEvent -FilterHashtable @{logname=‘application’;id=11707;data=‘abc.cd’}
What I do I want is collectting all logs that caused by the user abc.cd by using get-winevent , like he installs a new software , he starts a service ,he starts a scheduled task …
expected cmdlet:
Get-WinEvent -FilterHashtable @{logname=alllog;user=‘abc.cd’}
Sorry , I post this request in powershell user voice and powershell github repo at the same time, I really need some one help on this case ,I need to figure out who is doing shit on my computer