Detect NTLM v1 and v2 logons

Get-NtlmLogonEvents.ps1

$t1 = [datetime]::Today.AddHours(4).ToString('s')
$e = $null
$FilterXML = @"
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
(*[EventData[
Data[@Name="TargetDomainName"] != "Window Manager" and
Data[@Name="TargetDomainName"] != "Font Driver Host" and
Data[@Name="TargetDomainName"] != "NT AUTHORITY"
]])
and
*[System[(EventID='4624' and TimeCreated[@SystemTime > '$t1'])]]
</Select>
<Suppress Path="Security">*[System[(EventID=4799)]]</Suppress>
</Query>
</QueryList>
"@
$e = Get-WinEvent -FilterXML $FilterXML | Sort-Object -Property TimeCreated | ForEach-Object {
    [pscustomobject]@{
        TimeCreated = $_.TimeCreated
        Id = $_.Id
        AccountName = $_.Properties[5].Value
        AccountDomain = $_.Properties[6].Value
        MachineName = $_.Properties[11].Value
        AuthPackage = $_.Properties[10].Value
        Protocol = $_.Properties[14].Value
        LogonType = $_.properties[8].value
        ImpersonationLevel = $_.properties[20].value
        FullEvent = $_
    }
}
$e | Format-Table -Property *
Write-Host "Event Count $($e.Count)" -ForegroundColor Green