I would like to extract the following information from the Message property:
- Security Identifier
- Account Name
- Account Domain.
So far what I have is:
$UserLastLogonEvent = Get-WinEvent -Computer misw7v-120 -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 1 $UserLastLogonEvent | Format-List
The output is:
TimeCreated : 6/22/2016 3:30:38 PM
ProviderName : Microsoft-Windows-Security-Auditing
Id : 4672
Message : Special privileges assigned to new logon.
Subject:
Security ID:
S-1-5-22-67644591-240755714-2144928816-55394
Account Name: jdoe
Account Domain: BIGCORP
Logon ID: 0x1eb0edd
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
I am trying to learn string manipulation using regex, but I am far from an expert and I would be eternally grateful to anyone who can help me in solving this problem. The data that I need to extract from the Message property in the output above is bolded.
Thank you so much.