Код:
$today = [int](new-timespan ([datetime]::Today)(get-date)).TotalMilliseconds
$filter = "*[System[EventID=4624 and TimeCreated[timediff(@SystemTime)<=$today]] and EventData[Data[@Name='LogonType']=10]]"
Get-WinEvent Security -FilterXPath $filter | Select TimeCreated,@{n="UserName";e={$_.properties[5].value}},@{n="IP";e={$_.properties[18].value}}
