Get-WinEvent FilterXPath options

Hi dmarquesgn:

Append this to filter by a specific username:

and *[UserData[EventXML[@xmlns='Event_NS'][Param1='dmarquesgn']]]

The full xpath filter will look like this:

<QueryList><Query Id='0'><Select Path='Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'>*[System[(EventID=1149) and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]] and *[UserData[EventXML[@xmlns='Event_NS'][Param1='dmarquesgn']]]</Select></Query></QueryList>

Notes:

1. I created variables for the filterxpath and username out to separate variables
2. I replaced the Invoke-Command block with the "-ComputerName" parameter in the Get-WinEvent cmdlet.

Here's the full script block:

$computername = "servername"
$username = "dmarquesgn"
$FilterPath = "<QueryList><Query Id='0'><Select Path='Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'>*[System[(EventID=1149) and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]] and *[UserData[EventXML[@xmlns='Event_NS'][Param1='{0}']]]</Select></Query></QueryList>" -f $username

$RDPAuths = Get-WinEvent -ComputerName $computername -LogName 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' -FilterXPath $FilterPath

[xml[]]$xml=$RDPAuths | Foreach { $_.ToXml() }

$EventData = Foreach ($event in $xml.Event) {
    New-Object PSObject -Property @{
        TimeCreated = (Get-Date ($event.System.TimeCreated.SystemTime) -Format 'dd-MM-yyyy hh:mm:ss')
        User = $event.UserData.EventXML.Param1
        Domain = $event.UserData.EventXML.Param2
        Client = $event.UserData.EventXML.Param3
    }

} $EventData | FT