Parse Windows login event for specific details

Question

Hi,
I have a windows event that I want to search for in the event log using Powershell.  I've got the basics but can't find how to drill further into the details.  This is what I have so far:
get-eventlog security | where{$_.eventid -eq 4624 -and $_.message -match "Logon Type:\s+3"}
The problem is in the event details I have the following:
An account was successfully logged on.
Subject:
    Security ID:        NULL SID
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x0
Logon Type:            3
New Logon:
    Security ID:        test\administrator
    Account Name:        administrator
    Account Domain:        test
    Logon ID:        0x318df67
    Logon GUID:        {0b843e34-532c-e4c2-9577-2ee19684f472}
Process Information:
    Process ID:        0x0
    Process Name:        -
Network Information:
    Workstation Name:    
    Source Network Address:    192.168.10.11
    Source Port:        51446
How can I query for this information, as for example there are 2 instances of Security ID....
Thanks
James
Alter De Ruine

Answer 1

This blog post does not fully match your request but it shows how to deal with eventlog data in powershell and using the toxml method:
http://www.normanbauer.com/2012/01/10/how-to-get-detailed-information-on-windows-boot-and-shutdown-performance-in-powershell/
Basically you'll need something like the following code to start with:
#Get events in security log with id 4624
$items = Get-WinEvent -FilterHashtable @{logname="Security"; id=4624;}
#Get first item as xml
$xmlitem = [xml]$items[0].ToXml()
#Get EventID
$xmlitem.Event.System.EventID
#Get logging computer
$xmlitem.Event.System.Computer
#Get computer
$xmlitem.Event.EventData.Data | where-object {$_.Name -eq "SubjectUserName"}
#Get account
$xmlitem.Event.EventData.Data | where-object {$_.Name -eq "TargetUserName"}
#Get logon type
$xmlitem.Event.EventData.Data | where-object {$_.Name -eq "LogonType"}
#Get ip address
$xmlitem.Event.EventData.Data | where-object {$_.Name -eq "IpAddress"}
#Get all data
$xmlitem.Event.EventData.Data
In your example the duplicyte Security IDs resolve to - I think - SubjectUserName and TargetUserName.