Время входа пользователей

Get-EventLog -LogName Security | ? {$_.eventID -eq (4634) -or $_.eventID -eq 4624} |  %{
   $_.TimeGenerated
   $_.Message -match 'Account Name:\s+(\S+)\s' | out-null;
   $matches[1]
}

Get-EventLog -LogName Security | ? {$_.eventID -eq (4634) -or $_.eventID -eq 4624} | select first 1 | %{
   $_.TimeGenerated
   $_.Message 
}

get-winevent -LogName Security | Where-Object {$_.ID -eq '4624'} | 
Select -Property @{Name='Пользователь';Expression={$_.Properties[5].Value}},
@{Name='AccountDomain';Expression={$_.Properties[6].Value}},
@{Name='Время входа';Expression={$_.TimeCreated}} |  
Format-Table

$mass = $mass1 = @()
get-winevent -LogName Security -MaxEvents 500 | Where-Object {$_.ID -eq '4624'} | ?{$mass -notcontains ($_.Properties[5].Value)} | %{$mass+=$_.Properties[5].Value;$mass1+=$_.TimeCreated}