I'm looking to find a way to filter event 4624 by logon type. I want to only get logon type 2 and logon type 10. Since the logon type is written in the message of the event I can't think of a way to filter on it. The only way I've found is to dump all the 4624's to a text file via script and just search for type 2 and 10. But I'd like to automate this if possible.