Read-ProtectedEventlog.ps1

Get-WinEvent -FilterHashtable @{ 
    LogName = 'Microsoft-Windows-PowerShell/Operational' ; Id = 4104
} | ForEach-Object {
    if (([xml]$_.toXML()).Event.EventData.Data.InnerXml -match '^-----BEGIN CMS-----') {
        $_ | 
        Add-Member -MemberType NoteProperty -Name isProtected -Value $true -PassThru | 
        Add-Member -MemberType ScriptProperty -Name UnprotectedMessage -Value {
            try {
                $this.Message | Unprotect-CmsMessage -ErrorAction Stop
            } catch {
                [string]::Empty
            }
        } -PassThru
    } else {
        $_ | 
        Add-Member -MemberType NoteProperty -Name isProtected -Value $false -PassThru | 
        Add-Member -MemberType ScriptProperty -Name UnprotectedMessage -Value {
                $this.Message 
        } -PassThru    
    }
} | 
Select Message,TimeCreated,isProtected,UnprotectedMessage | 
Out-GridView