$xml=@"
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[EventData[Data[@Name='ProcessName'] and (Data='c:\windows\system32\winlogon.exe')]] and *[System[(EventID=4625) and TimeCreated[timediff(@SystemTime) <= 3600000]]]</Select>
</Query>
</QueryList>
"@
$xml2=@"
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[band(Keywords,4503599627370496) and (EventID=4625)]]</Select>
</Query>
</QueryList>
"@
$events = Get-WinEvent -FilterXml $xml2
$events.count
$events[0]|select *
$eventXML = [xml]$events[0].ToXml()
$EventObject = New-Object system.object
foreach ($e in $eventXML.Event.EventData.Data)
{ Add-Member -InputObject $EventObject -MemberType NoteProperty -Name $e.name -Value $e.'#text' }
$EventObject.SubjectUserName
https://www.jb51.net/article/73204.htm