Event Log Readers

• 
• Administrators or members of the Event Log Readers group have permission to access this log.
• It is conceivable that system administrators might want to add power users or developers into this group to perform certain tasks without having to grant them administrative access.

---

• Confirming Group Membership
  • net localgroup "Event Log Readers"
• Searching Security Logs Using wevtutil
  • wevtutil qe Security /rd:true /f:text | Select-String "/user"
  • We can also specify alternate credentials for wevtutil using the parameters /u and /p.
• Passing Credentials to wevtutil
  • wevtutil qe Security /rd:true /f:text /r:share01 /u:julie.clay /p:Welcome1 | findstr "/user"
• Searching Security Logs using Get-WinEvent
  • Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }}
  • 
  •