-
특정 이벤트 뷰어를 보고 싶다.
Get-WinEvent -FilterHashtable @{Logname='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'; id=25} -MaxEvents 1| Format-List -Property *
Get-EventLog -LogName Security -Newest 1 -InstanceId 4625 | Select MachineName,Message,TimeWritten,TimeGenerated | Format-List *