How to use PowerShell to parse the security log on 2008 to output User names.

I've got several web servers that at times I need to know dates and times that a specific user, or handful of users were connected.  I easily do this by running the following PowerShell command on the specific web servers:

get-eventlog security -newest 1000 | select-object TimeGenerated,EntryType,EventID,UserName | where-object {$_.UserName -eq "Domain\UserName"} | group-object TimeGenerated,Username

The problem is, this only works on Windows 2003, and for the life of me, I can't figure out what properties I need to pull to get the same information on my 2008 servers.

Any assistance you can provide would be greatly appreciated.

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I think your problem is that they (for whatever reason) moved the user name to the actual message. IIRC, It is no longer the event user.

I suppose your best bet is RegEx'ing the message field

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sermanreAuthor Commented:
That was the same conclusion I had come up with. :( I guess it's time to figure out how to use RegEx.  I'll leave this open a for a few days just in case someone else comes up with an alternative.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.