PowerShell: Find Security Events in Event Log

Need to check for security-related activity - logins, account changes, or lockouts - for security auditing or investigating suspicious activity? This one-liner filters the Security log for the most commonly monitored events at once.

Prerequisites:

• Privileges: Run as Administrator
• Module: Built-in, no import needed

Quick Command:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648,4720,4722,4725,4732,4740} -MaxEvents 5

Example Output:

ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
7/27/2026 12:29:01 PM         4624 Information      An account was successfully logged on...
7/27/2026 12:24:18 PM         4624 Information      An account was successfully logged on...
7/27/2026 12:18:58 PM         4624 Information      An account was successfully logged on...

How It Works:

• LogName='Security' targets the Security log - unlike System or Application, this requires Administrator privileges to read, since it contains sensitive audit data.
• Id=4624,4625,4648,4720,4722,4725,4732,4740 filters for several commonly monitored security events at once: 4624/4625 (successful/failed logins), 4648 (explicit credential logon, like runas), 4720/4722/4725 (account created/enabled/disabled), 4732 (added to a security group), and 4740 (account locked out).
• -MaxEvents 5 limits the output to the most recent matches, since a busy system can generate a large volume of security events.

Pro Tip:

To focus on just account-related changes (creation, enabling, disabling, lockouts) without the high-volume login noise, drop 4624 and 4625 from the filter:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648,4720,4722,4725,4732,4740} -MaxEvents 5