title: get-winevent: working with properties
body: <p>I try to learn powershell to automate some daily tasks. </p>
  
  <p>I try to figure out all fieldnames from the get-winevent function to understand what i need to do when i want to filter a result from a lot of eventid's with several conditions. </p>
  
  <p>In this simple example i want all events 4625 and the events from 4624 but only if logontype is 2. The resulttable should only include the given fields (for now all fields, later on selected fields and one custom field).
  Additionaly i would like to mark local logins and remotelogins in a specific column with "local" or "remote" and network-data (IP, username, hostname).</p>
  
  <pre><code>Get-winevent -FilterHashtable @{Path="c:\temp\test.evtx";} |
  Where-Object {$_.Id -eq 4624 -and $_.properties[8].value -in 2} 
  -or
  {$_.Id -eq 4625}| export-csv ($EventlogTempFolder+$_.basename + ".csv") -encoding UTF8 -NoTypeInformation -force
  </code></pre>
  
  <p>How can i get a list of all fields? From ID to all property-fields in the message-field?</p>
  
  <p>Btw.: this code did not work as expected. sorry for that. </p>