Whenever things go sideways, or the operating system behaves in a way that was neither planned nor foreseeable, Windows administrators have grown accustomed to accessing the event log. Regrettably, many administrators are still using the graphical user interface for that.

The trade-off of a colorful UI, of course, is that it does not scale. How are you going to consolidate the event you are looking for on hundreds of servers? How can you efficiently parse the event log for that one piece of information hidden in some event? Why, by using PowerShell Core, of course.

This recipe will introduce you to the Get-WinEvent cmdlet and its filtering capabilities with a very typical task: parsing the security logs for one specific user logon.