C:\PowerShell\AppendixB> get-eventlog -list
Max(K) Retain OverflowAction Entries Name
------ ------ -------------- ------- ----
512 7 OverwriteOlder 486 Application
512 7 OverwriteOlder 0 Internet Explorer
512 7 OverwriteOlder 1 Security
512 7 OverwriteOlder 2,166 System

PS C:\Users\Administrator> Get-Eventlog -Logname Security


Get-Eventlog -LogName Security|Where-Object {$_.message -match "Microsoft-Windows-Security-Auditing"}
C:\Users\Administrator> Get-EventLog -LogName "Security" | Where-Object {$_.InstanceID -match "4624"}
PS C:\Users\Administrator> Get-EventLog -LogName "Security" | Where-Object {$_.InstanceID -match "4624"}
PS C:\Users\Administrator> Get-EventLog -LogName "Security" | Where-Object {$_.InstanceID -match "4624"} | ConvertTo-Html -Title "intanceid=4624" | Ou
t-File 4624.html
powershell -ExecutionPolicy RemoteSigned "Get-EventLog -LogName 'Security' -newest 100| Where-Object {$_.eventid -eq 4624 -and $_.Message-like '*maltfun*'}" > C:\Windows\Temp\1.txt
Get-EventLog -LogName "Security" | Where-Object {$_.InstanceID -match "4624"} | ConvertTo-Html -Title "intanceid=4624" | Out-File 4624.html
Get-EventLog -LogName "Security" -newest 100| Where-Object {$_.eventid -eq 4624 -and $_.Message-like "*username*"}
get-eventlog -logname "security"  | group-object -property eventid