In a previous Post I mentioned that certain data from the event log can be found Replacement String. See the Article : Track User Logon Events with Power Shell But for every event there must surely be different replacement strings Read More …