Search Through Event Logs With Powershell
Search through event logs using Get-WinEvent: Reference
#Get full list of event log names to use in filters:
Get-WinEvent -ListLog *
#Get events from multiple logs in a time period (last day)
$StartDate = (Get-Date) - (New-TimeSpan -Day 1)
Get-WinEvent Application,System | Where-Object {($_.LevelDisplayName -eq "Error" -or $_.LevelDisplayName -eq "Warning") -and ($_.TimeCreated -ge $StartDate )}
#Search for events in a specific time period
Get-winevent -filterhashtable @{logname="Microsoft-Windows-TerminalServices-SessionBroker/Operational"; starttime="12:20pm"; EndTime="12:25pm"} | Where-Object {$_.Message -like "*<username>*"}
#Find Events by ID
Get-WinEvent -FilterHashtable @{logname='System';id=1074}|ft TimeCreated,Id,Message
#Find Specific Text in message
Get-WinEvent -FilterHashtable @{logname='System'}|Where {$_.Message -like "*USB*"}
#Get Events from Remote computers
$servers = @("server1","Server2")
$servers | foreach-object {Get-WinEvent -ComputerName $_ -FilterHashtable @{logname="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"} | Where-Object {$_.Message -like "*<username>*"}}