# Powershell Script

**URL:** <https://forums.powershell.org/t/powershell-script/11630>\
**Category:** PowerShell Help\
**Created:** [November 6, 2018, 4:47pm UTC](https://forums.powershell.org/t/powershell-script/11630 "2018-11-06T16:47:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rocketship234](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@rocketship234](https://forums.powershell.org/u/rocketship234)\
**Post date:** [November 6, 2018, 4:47pm UTC](https://forums.powershell.org/t/powershell-script/11630/1 "2018-11-06T16:47:29Z")

</div>

I am trying to extract Logs from event viewer security log. I am trying to find the easiest way. I believe using Powershell to get this data is the easiest way. I am trying to get a nice excel document on employee logons to a server. The event codes i need are 4985 and 5140. They typically login using Citrix Xenapp. What I need is the Subject details to show. The security ID or Account name would be an easy way to identify a user.

I can get the event logs using Get-Eventlog using this command. What i need is the account name or security ID of specific user, otherwise that other data would be useless for me.

Any help would be Greatly Appreciated,

&nbsp;

Michael D.

---

<div class="post-metadata">

**Author:** ![rob-simmers](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/rob-simmers/32/1010_2.png) [@rob-simmers](https://forums.powershell.org/u/rob-simmers)\
**Post date:** [November 6, 2018, 4:59pm UTC](https://forums.powershell.org/t/powershell-script/11630/2 "2018-11-06T16:59:02Z")

</div>

Try using Get-WinEvent which will allow you to get the full details in events.

> **[Filtering Event Log Events with PowerShell](https://devblogs.microsoft.com/scripting/filtering-event-log-events-with-powershell/)**
>
> Summary: Ed Wilson, Microsoft Scripting Guy, talks about filtering event log events with the Get-WinEvent cmdlet.  Hey, Scripting Guy! I try to use the Get-WinEvent cmdlet to search event logs, but it is pretty hard to do. Also, I don’t see the...

---

<div class="post-metadata">

**Author:** ![shihanpietersz](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@shihanpietersz](https://forums.powershell.org/u/shihanpietersz)\
**Post date:** [November 6, 2018, 5:09pm UTC](https://forums.powershell.org/t/powershell-script/11630/3 "2018-11-06T17:09:38Z")

</div>

Hi Michael,

I had created a script sometime back to get account lockout notifications. below is a a snippet form that which might help get what you are after

```
$Events = Get-WinEvent -ComputerName $DC -FilterHashtable @{LOGNAME='Security';ID="4985"} -ErrorAction Stop

foreach ($event in $Events){

$Properties= [PSCustomObject][Ordered]@{

"Username"=$event.Properties[0].value

"ReferenceComputer"=$Event.Properties[1].value

"LockOutTime"=$event.TimeCreated

"Domain"=$Event.Properties[5].value

"DC"=$Event.Properties[4].value -replace"\$"

}

$Properties

}
```

Script published on the PowerShell gallery for reference

https://www.powershellgallery.com/packages/AdUserLockoutInformation/1.0.0.2

Regards

Shihan

---

<div class="post-metadata">

**Author:** ![rocketship234](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@rocketship234](https://forums.powershell.org/u/rocketship234)\
**Post date:** [November 7, 2018, 3:02pm UTC](https://forums.powershell.org/t/powershell-script/11630/4 "2018-11-07T15:02:15Z")

</div>

Thank you this information pointed me in the right direction and I was able to obtain what I needed.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:34pm UTC](https://forums.powershell.org/t/powershell-script/11630/5 "2024-05-16T20:34:48Z")

</div>