Below is my code: which returns the time value in excel as : System.Xml.XmlElement
I need to fix the time issue first, and hopefully its readable in normal time.
____________________
$query=@{
#date = (Get-Date).AddHours(-100)
id = 4624
level = 0
logname = "security"
}
$pc = $env:COMPUTERNAME
$log = (Get-WinEvent -ComputerName $pc -FilterHashTable @{LogName=$query.logname; Level=$query.level; id=$query.id})
[xml[]]$xmllog = $log.toXml()
foreach ($i in $xmllog) {
[int32]$a = $i.event.eventdata.data[8].'#text'
if(($a -eq '7') -or ($a -eq '10')){
$array = New-object PSObject -Property([ordered]@{`
"Time"=$i.Event.System.TimeCreated
"Target Computer" = $i.Event.System.Computer
"User Logged In"=$i.Event.EventData.Data[5].'#text'
#if($i.event.eventdata.data[5].'#text' -eq $i.event.eventdata.data[5].'#text'){continue}
"Logon Type"=$i.Event.EventData.Data[8].'#text'
"Ip Address"=$i.Event.EventData.Data[18].'#text'
})
}
else{continue}
$array |Export-Csv -UseCulture -Encoding UTF8 -NoTypeInformation C:\$pc.csv -Append
}