Windows 2008 аудит журналов доступа

$event = New-Object System.Management.Automation.PSObject
$event | Add-Member NoteProperty Event ($null)
$event | Add-Member NoteProperty Code ($null)
$event | Add-Member NoteProperty Time ($null)
$event | Add-Member NoteProperty UserName ($null)
$event | Add-Member NoteProperty Address ($null)

$log | %{
$event.Event = $_.eventid
$event.Code = ($message | ?{$_ -like "*Logon Type:*"} | %{$_ -replace "^.+`t *"})
$event.time = $_.TimeGenerated; $message = $_.message.split("`n") | %{$_.trimstart()} | %{$_.trimend()}
$user=($message | ?{$_ -like "*Account Name:*"} | %{$_ -replace "^Account Name:`t`t *"})
$event.UserName = $user[1]
$event.Address = ($message | ?{$_ -like "Source Network Address:*"} | %{$_ -replace "^.+`t *"})
$event
}