> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Find Security Events in Event Log
- URL: https://www.filipkonopik.com/powershell-find-security-events-in-event-log/
- Published: 2026-07-27T10:38:19.000Z
- Updated: 2026-08-06T05:45:02.000Z
- Author: Filip Konopík
- Tags: Event Logs & Monitoring

Need to check for security-related activity - logins, account changes, or lockouts - for security auditing or investigating suspicious activity? This one-liner filters the Security log for the most commonly monitored events at once.

Prerequisites:

- Privileges: Run as Administrator
- Module: Built-in, no import needed

Quick Command:

```Powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648,4720,4722,4725,4732,4740} -MaxEvents 5
```

Example Output:

```Powershell
ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
7/27/2026 12:29:01 PM         4624 Information      An account was successfully logged on...
7/27/2026 12:24:18 PM         4624 Information      An account was successfully logged on...
7/27/2026 12:18:58 PM         4624 Information      An account was successfully logged on...
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- LogName='Security' targets the Security log - unlike System or Application, this requires Administrator privileges to read, since it contains sensitive audit data.
- Id=4624,4625,4648,4720,4722,4725,4732,4740 filters for several commonly monitored security events at once: 4624/4625 (successful/failed logins), 4648 (explicit credential logon, like runas), 4720/4722/4725 (account created/enabled/disabled), 4732 (added to a security group), and 4740 (account locked out).
- \-MaxEvents 5 limits the output to the most recent matches, since a busy system can generate a large volume of security events.

Pro Tip:

To focus on just account-related changes (creation, enabling, disabling, lockouts) without the high-volume login noise, drop 4624 and 4625 from the filter:

```Powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648,4720,4722,4725,4732,4740} -MaxEvents 5
```