How to Access Windows Security Event Logs with PowerShell

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

Use PowerShell’s Get-WinEvent cmdlet to read the Windows Security event log. First confirm that the log is available and that your account can read it; then filter events by ID, time, or other criteria. Reading the log does not enable auditing: Windows must already be configured to generate the events you want.

Quick start

Run these commands in PowerShell on Windows:

# Check the Security log
Get-WinEvent -ListLog Security

# Read the newest 20 events
Get-WinEvent -LogName Security -MaxEvents 20

# Find successful and failed logons from the past 24 hours
Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4624, 4625
    StartTime = (Get-Date).AddHours(-24)
}

Get-WinEvent is the modern choice for Windows Event Log queries. It works on Windows, including Windows PowerShell and PowerShell 7 on Windows, but is not a cross-platform event-log reader. Microsoft documents its syntax and filtering options in the Get-WinEvent reference.

#	Preview	Product	Price
1		Learn PowerShell in a Month of Lunches, Fourth Edition: Covers Windows, Linux, and macOS	$39.99	Buy on Amazon
2		Mastering PowerShell Scripting: Automate repetitive tasks and simplify complex administrative tasks...	$32.49	Buy on Amazon
3		Powershell for Beginners A Step-by-Step Guide to Learning Scripting, Cmdlets: Learn PowerShell...	$24.99	Buy on Amazon
4		PowerShell Pocket Reference: Portable Help for PowerShell Scripters	$18.99	Buy on Amazon
5		Windows PowerShell Step by Step	$24.14	Buy on Amazon

What the Security log contains

The Security channel holds security and audit events recorded by Windows. It is separate from the System and Application logs, the Windows PowerShell log, and Microsoft-Windows-PowerShell/Operational. PowerShell command and script-block logging commonly appears in the latter channel, not necessarily in Security; see Microsoft’s PowerShell logging documentation.

A log can exist and be readable even when it contains no events matching your question. Many event types are recorded only when the corresponding audit policy is enabled. Get-WinEvent retrieves what Windows has recorded; it does not turn auditing on.

#1 Best Overall

Learn PowerShell in a Month of Lunches, Fourth Edition: Covers Windows, Linux, and macOS

$39.99

Buy on Amazon

Check the log and your access

$securityLog = Get-WinEvent -ListLog Security
$securityLog | Select-Object LogName, IsEnabled, RecordCount,
    MaximumSizeInBytes, LogFilePath, LogMode, LastWriteTime

# Show all properties returned for this log
Get-WinEvent -ListLog Security | Format-List *

You can also inspect the configuration with the built-in wevtutil utility:

wevtutil gl Security

It displays configuration such as the log path, size, retention settings, and access information. See Microsoft’s wevtutil documentation.

If a query returns Access is denied, opening PowerShell as Administrator may help, but elevation is not a universal fix. Access depends on the target computer’s event-log permissions and security policy. Microsoft documents ways to configure event-log access through local policy, Group Policy, and security descriptors; prefer narrowly delegated read access over making every analyst a local administrator, and do not grant log-clearing rights without a documented need. See Microsoft’s event-log permissions guidance and its Security log access troubleshooting article.

Read and format recent events

Results are newest first by default. Limit output with -MaxEvents and choose useful properties for the task:

Get-WinEvent -LogName Security -MaxEvents 20 |
    Select-Object TimeCreated, Id, Version, LevelDisplayName,
        ProviderName, MachineName, Message |
    Format-List

For a compact overview, use a table:

Get-WinEvent -LogName Security -MaxEvents 50 |
    Select-Object TimeCreated, Id, LevelDisplayName, ProviderName |
    Format-Table -AutoSize

A Security log can be large. Filter at the query stage rather than retrieving everything and then piping it through Where-Object; filtering in the event-log API can avoid reading a much larger set than necessary.

Filter by event ID and time

Use -FilterHashtable for common queries. Its keys include LogName, Id, ProviderName, Level, StartTime, EndTime, UserID, and event-data filters. The Microsoft FilterHashtable examples explain supported filters.

Rank #2

Sale

Mastering PowerShell Scripting: Automate repetitive tasks and simplify complex administrative tasks using PowerShell

$32.49

Buy on Amazon

# Failed logons in the last seven days
Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4625
    StartTime = (Get-Date).AddDays(-7)
} | Select-Object TimeCreated, Id, Message

For a fixed interval, supply both endpoints:

$start = Get-Date '2026-08-17 00:00:00'
$end   = Get-Date '2026-08-18 00:00:00'

Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4624, 4625
    StartTime = $start
    EndTime   = $end
}

Use times appropriate to the computer and PowerShell session. For investigations spanning multiple hosts, record the source computer and time zone, and normalize timestamps before comparing events.

Filter by account

UserID can accept an account name that Windows can resolve or a SID. Resolving to a SID is a reliable option for reusable scripts:

$sid = (New-Object System.Security.Principal.NTAccount('CONTOSOalice')).Translate(
    [System.Security.Principal.SecurityIdentifier]
).Value

Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    UserID  = $sid
}

Keep in mind that the record’s user identity is not always the same as every account named inside its event data. Events may identify a subject, a target account, or the account that logged on. If you need to search a particular field within the payload, inspect the event’s structured data rather than assuming UserID searches every displayed username.

Inspect complete event data

The rendered Message is convenient, but it may not expose every field or may be unavailable if provider metadata is missing. Inspect the event object and its XML:

$event = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id      = 4624
} -MaxEvents 1

$event | Format-List *
$event.ToXml()

# Values in the event's structured Properties collection
$event.Properties | ForEach-Object { $_.Value }

Property positions vary by event type, schema, and Windows version. Avoid scripts that assume a fixed index such as Properties[5] has the same meaning everywhere. For dependable tooling, use the event XML’s named fields and the relevant provider documentation, and test against the Windows versions you support.

Useful Security event IDs

These IDs are starting points, not verdicts. Interpret them using the full event payload, audit configuration, account type, host role, and surrounding events. Microsoft’s Windows security event reference lists these and many additional IDs.

Rank #3

Powershell for Beginners A Step-by-Step Guide to Learning Scripting, Cmdlets: Learn PowerShell Basics, Automate IT Tasks, and Boost Productivity with Clear Examples and Practical Exercises

$24.99

Buy on Amazon

Use XPath for more precise queries

XPath can express conditions that are useful when filtering by event time and ID together. This example looks for failed logons from approximately the last 24 hours:

$xpath = '*[System[(EventID=4625) and TimeCreated[timediff(@SystemTime) <= 86400000]]]' 
Get-WinEvent -LogName Security -FilterXPath $xpath

To include successful logons in the last hour:

$xpath = '*[System[(EventID=4624 or EventID=4625) and TimeCreated[timediff(@SystemTime) <= 3600000]]]' 
Get-WinEvent -LogName Security -FilterXPath $xpath

For complex queries across channels, use -FilterXml. Event Viewer can generate query XML from Create Custom View or Filter Current Log; you can then adapt that query for PowerShell. The Get-WinEvent reference covers -FilterXPath and -FilterXml.

Query another computer

Use -ComputerName to query a remote Windows host. This uses the Windows Event Log remote-access mechanism; it does not inherently require a PowerShell remoting session.

Get-WinEvent -ComputerName SERVER01 -LogName Security -MaxEvents 20

For a credential and a narrower query:

$credential = Get-Credential

Get-WinEvent -ComputerName SERVER01 -Credential $credential -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4625
    StartTime = (Get-Date).AddHours(-8)
}

Remote access requires a reachable target, a running Windows Event Log service, suitable Security-log read permissions, and firewall and policy settings that allow remote event-log management. Authentication also depends on the domain, workgroup, trust, and credential context. Microsoft’s cmdlet documentation notes the need for firewall access to the event-log service.

For several hosts, handle failures separately so one unreachable computer does not end the collection:

$computers = 'SERVER01', 'SERVER02', 'SERVER03'

foreach ($computer in $computers) {
    try {
        Get-WinEvent -ComputerName $computer -FilterHashtable @{
            LogName   = 'Security'
            Id        = 4625
            StartTime = (Get-Date).AddHours(-24)
        } -ErrorAction Stop |
            Select-Object MachineName, TimeCreated, Id, Message
    }
    catch {
        [pscustomobject]@{
            Computer = $computer
            Error    = $_.Exception.Message
        }
    }
}

Domain controllers and hardened servers may have stricter policies, and their events describe activity in the context of the host’s role. Correlate the logon type, source workstation or IP, account domain, authentication package, and related events on other systems.

Rank #4

Sale

PowerShell Pocket Reference: Portable Help for PowerShell Scripters

$18.99

Buy on Amazon

Read an archived event file

To query an exported .evtx file, use -Path instead of -LogName:

Get-WinEvent -Path 'C:EvidenceSecurity.evtx' -MaxEvents 50

Get-WinEvent -Path 'C:EvidenceSecurity.evtx' -FilterHashtable @{
    Id        = 4625
    StartTime = (Get-Date).AddDays(-1)
}

If you need the earliest records first, add -Oldest:

Get-WinEvent -Path 'C:EvidenceSecurity.evtx' -Oldest -MaxEvents 100

-Path also supports .evt and ETL files, subject to the file’s schema and provider availability. For forensic work, preserve the original, calculate and record a hash, work from a copy, and capture acquisition details. A message may render differently if the machine lacks the provider metadata used by the source system.

Export query results

CSV is convenient for reports and spreadsheets, but it flattens event data:

Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4624, 4625
    StartTime = (Get-Date).AddDays(-1)
} |
    Select-Object MachineName, TimeCreated, Id, ProviderName,
        LevelDisplayName, Message |
    Export-Csv -Path .security-events.csv -NoTypeInformation -Encoding UTF8

For PowerShell object preservation, use CLIXML. For exact provider fields and schemas, save each event’s XML:

# Preserve PowerShell objects
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625 } |
    Export-Clixml -Path .failed-logons.xml

# Save raw event XML documents
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625 } |
    ForEach-Object { $_.ToXml() } |
    Set-Content -Path .failed-logons-raw.xml -Encoding UTF8

Event records can contain account names, addresses, command lines, and other sensitive data. Store exports with appropriate access controls and retention, especially when command-line auditing is enabled.

Best Value

Sale

Windows PowerShell Step by Step

$24.14

Buy on Amazon

If the log is empty or events are missing

1. Check the query scope. Confirm the selected computer, event ID, and time range. Try a small recent query without extra filters.
2. Check permissions. If access is denied, verify the account’s read rights and any local or Group Policy configuration. Do not assume that membership in a particular group grants Security-log access on every system.
3. Check audit policy. If the event type was not being audited, Windows may never have recorded it. Use the approved policy-management method to enable the required audit subcategory, then generate a test action and query for its event.

auditpol /list /category:*
auditpol /get /category:*

auditpol can list categories and retrieve configured audit policy; querying policy itself requires suitable permission. See Microsoft’s auditpol list and auditpol get documentation.

When enabling auditing, identify the needed category or subcategory, configure it through the organization’s approved local or Group Policy process, generate a test event, and confirm its fields. Local settings can be overridden by domain policy. Avoid enabling broad auditing without considering log volume, storage, privacy, and operational impact.

Troubleshoot common errors

“Access is denied”

Check which identity is running the query and whether the target log has customized permissions:

whoami /groups
Get-Service EventLog
Get-WinEvent -ListLog Security

For remote queries, also check firewall rules, credentials, target-side permissions, and whether the query works locally on the target. A damaged or incorrect Security event-log permission configuration can also prevent access; consult Microsoft’s troubleshooting guidance rather than making unverified registry changes.

Remote query fails

Test network reachability, then verify the Event Log service and remote event-log firewall rules. Check domain or workgroup authentication and the caller’s rights on the target. PowerShell remoting being available does not, by itself, prove that remote Event Log access is configured.

Query is slow

Narrow by log, ID, and start/end time in -FilterHashtable or XPath. Avoid downloading the whole Security log and filtering afterward.

Message or fields are missing

Inspect Format-List * and ToXml(). Provider metadata may be absent, the schema may differ between systems, or the information may be present in XML but not in the rendered message. Do not rely on a fixed Properties index across event types or Windows versions.

Older events are unavailable

The log’s configured size and retention behavior determine how long records remain; newer events may overwrite older ones. Check Get-WinEvent -ListLog Security or wevtutil gl Security for configuration, and use a centrally managed collector when investigation requires longer retention across many computers.

Choosing the right tool

• Get-WinEvent: Best default for modern Windows logs, structured filtering, remote queries, and archived event files.
• Get-EventLog: Retained for legacy scripts and classic logs, but limited compared with Get-WinEvent.
• wevtutil: Useful for log configuration and administration when you need a command-line utility rather than PowerShell objects.
• Event Viewer: Useful for interactive inspection and creating custom queries that can be adapted for scripts.
• Centralized collection: Consider a SIEM or event collector when you need multi-host correlation, alerting, or longer retention; it is not required to inspect one local log.

Start with built-in tools for a focused query. Consider centralized collection only when your retention and investigation needs justify the deployment, privacy, and ingestion costs.

Quick Recap

Bestseller No. 1

Learn PowerShell in a Month of Lunches, Fourth Edition: Covers Windows, Linux, and macOS

$39.99

SaleBestseller No. 2

Mastering PowerShell Scripting: Automate repetitive tasks and simplify complex administrative tasks using PowerShell

$32.49

Bestseller No. 3

Powershell for Beginners A Step-by-Step Guide to Learning Scripting, Cmdlets: Learn PowerShell Basics, Automate IT Tasks, and Boost Productivity with Clear Examples and Practical Exercises

$24.99

SaleBestseller No. 4

PowerShell Pocket Reference: Portable Help for PowerShell Scripters

$18.99

SaleBestseller No. 5

Windows PowerShell Step by Step

$24.14

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.