PowerShell - Windows Login Audit

quickaudit.ps1

Write-Host "Getting Login Events"
$Out = @()
$List = Get-EventLog Security -Computer localhost | Where-Object {$_.InstanceId -eq 4624}
ForEach($Entry in $List) {
     
    If($Entry.ReplacementStrings[18] -notcontains "-"){
     
    $Out += New-Object PSObject -Property @{
        InstanceID = $Entry.InstanceId
        User = $Entry.ReplacementStrings[5]
        SourceIP = $Entry.ReplacementStrings[18]
        Time = $Entry.TimeGenerated
        Type = $Entry.EntryType
    }
   }
     
}
# Write the results to a Grid
$Out | Select * | Sort Time -Descending | Out-GridView