Querying event logs for audit failures within a specified time

Query the event log for audit failure within a specified time, you must add namespace, otherwise no return

$s= Get-date"3/30/2016 13:54:03"$e= Get-date"3/30/2016 13:55:03"$stime= [System.management.managementdatetimeconverter]::todmtfdatetime ($s)$etime= [System.management.managementdatetimeconverter]::todmtfdatetime ($e)Get -ciminstanceWin32_NTLogEvent-namespace "root\cimv2"-Filter "logfile= ' security ' and type= ' audit failed ' and timegenerated>= ' $stime ' and timegenerated<= ' $etime '"

If you use GWMI, the time format needs to be converted again and cannot be used directly.

Get-ciminstance needs PS3.0 support.

Querying event logs for audit failures within a specified time