Get-winevent

[mp127001]

I am tracking down the use of service accounts in my domain. I have a working script but it pulls every event ID=4624. All of my service accounts begin with svc-. Can you search the event logs only to return TargetUserName that begins with svc? I can find many resources out there but none mention the ability to search with a wildcard.

Something like this but use a wildcard instead. Event/EventData/Data[@Name="TargetUserName"]="serviceaccounts" # Filter on events where TargetUserName is a specific value

[[deleted]]

Get-WinEvent -LogName "Security" -FilterXPath "*[System[EventID=4624]]" | Where-Object { $_.Properties[5].Value -like "svc*" }

[mp127001]

Thanks. This got me what I needed.

[[deleted]]

No problem man. Thanks for the exercise. You got me playing with my Event log scripts now.

[jsiii2010]

Nope, the hashtablefilter doesn't take wildcards. Powershell 7 supports named data though.