Eventviewer

Search Through Event Logs With Powershell

Search through event logs using Get-WinEvent: Reference

#Get full list of event log names to use in filters:
Get-WinEvent -ListLog *

#Get events from multiple logs in a time period (last day)
$StartDate = (Get-Date) - (New-TimeSpan -Day 1)
Get-WinEvent Application,System | Where-Object {($_.LevelDisplayName -eq "Error" -or $_.LevelDisplayName -eq "Warning") -and ($_.TimeCreated -ge $StartDate )}

#Search for events in a specific time period
Get-winevent -filterhashtable @{logname="Microsoft-Windows-TerminalServices-SessionBroker/Operational"; starttime="12:20pm"; EndTime="12:25pm"} | Where-Object {$_.Message -like "*<username>*"}

#Find Events by ID
Get-WinEvent -FilterHashtable @{logname='System';id=1074}|ft TimeCreated,Id,Message

#Find Specific Text in message
Get-WinEvent -FilterHashtable @{logname='System'}|Where {$_.Message -like "*USB*"}

#Get Events from Remote computers
$servers = @("server1","Server2")
$servers | foreach-object {Get-WinEvent -ComputerName $_ -FilterHashtable @{logname="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"} | Where-Object {$_.Message -like "*<username>*"}}