Security event log parsing

Mark Scholl · Guest

I have a Bank client where the examiners have requested that the security
event log be dumped, printed and reviewed daily for events showing user
login and logout events. They have only one domain controller.

Event ID's 538 and 540 appear to be the events I would like to filter.
However, There are many events from the system user that I would like to
exclude using these event ID's.

I've looked at PSLogList from the PSTools suite but I don't find a switch to
exclude the events from the system user.

Any easy options?

mark scholl