# New request -- get-winevent: get all log generated by a specific user

**URL:** <https://forums.powershell.org/t/new-request-get-winevent-get-all-log-generated-by-a-specific-user/13013>\
**Category:** PowerShell Help\
**Created:** [August 17, 2019, 10:13pm UTC](https://forums.powershell.org/t/new-request-get-winevent-get-all-log-generated-by-a-specific-user/13013 "2019-08-17T22:13:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tlsalex](https://avatars.discourse-cdn.com/v4/letter/t/439d5e/32.png) [@tlsalex](https://forums.powershell.org/u/tlsalex)\
**Post date:** [August 17, 2019, 10:13pm UTC](https://forums.powershell.org/t/new-request-get-winevent-get-all-log-generated-by-a-specific-user/13013/1 "2019-08-17T22:13:57Z")

</div>

If I try to find when the user abc.cd logon to my computer.  
I will do a log query as follow.  
`Get-WinEvent -FilterHashtable @{logname=‘security’;data=‘abc.cd’;id=4624}`

If I want to know when a software was install on computer.  
I will do a log query as follow.  
`Get-WinEvent -FilterHashtable @{logname=‘application’;id=11707}`

but It does not work with a user ID as follow.  
`Get-WinEvent -FilterHashtable @{logname=‘application’;id=11707;data=‘abc.cd’}`

What I do I want is collectting all logs that caused by the user abc.cd by using get-winevent , like he installs a new software , he starts a service ,he starts a scheduled task …

expected cmdlet:  
`Get-WinEvent -FilterHashtable @{logname=alllog;user=‘abc.cd’}`

Sorry , I post this request in powershell user voice and powershell github repo at the same time, I really need some one help on this case ,I need to figure out who is doing shit on my computer

---

<div class="post-metadata">

**Author:** ![p0wd3r](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@p0wd3r](https://forums.powershell.org/u/p0wd3r)\
**Post date:** [August 21, 2019, 5:12pm UTC](https://forums.powershell.org/t/new-request-get-winevent-get-all-log-generated-by-a-specific-user/13013/2 "2019-08-21T17:12:03Z")

</div>

```
Get-WinEvent -LogName "security" -MaxEvents 100 | where {$_.message -like "*abc.cd*"}
```

You will need to search the other logs, the name match up with event viewer (security, application, etc…), also I set MaxEvents to 100 for speed.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:31pm UTC](https://forums.powershell.org/t/new-request-get-winevent-get-all-log-generated-by-a-specific-user/13013/3 "2024-05-16T20:31:45Z")

</div>