How to export Windows Security events in PowerShell: step by step

This guide shows how to export events from the Windows Security log in PowerShell for analysis, auditing and integration with other tools. Knowing how to filter by ID, time range and export to CSV or XML is useful to detect authentication failures, policy changes or suspicious activity.

Prerequisites

• Windows 10/11 or Windows Server with PowerShell 5.1 or PowerShell 7 installed.
• Administrative permissions to read the Security log.
• Text editor (Notepad, VS Code) to save scripts.

Step 1: Understand the log and common Event IDs

Before running commands, it’s important to know that the Security log contains events such as logon failures (Event ID 4625), successful logons (4624) and privilege changes (4672). Identifying the Event IDs you care about makes filtering easier and reduces the data volume.

Step 2: List recent events with Get-WinEvent

Get-WinEvent is more flexible than Get-EventLog for modern logs. Use a simple filter to see the 50 most recent events from the Security channel.

Get-WinEvent -LogName Security -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

Step 3: Filter by Event ID and time range

To search for specific events, combine a Hashtable filter with Get-WinEvent. Example: all Event ID 4625 in the last 7 days.

$filter = @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)}
Get-WinEvent -FilterHashtable $filter | Select-Object TimeCreated, Id, Message

Step 4: Filter by multiple Event IDs

When you need multiple Event IDs (e.g.: 4624 and 4625) use an array in the filter. This is useful to compare logon successes and failures.

$ids = @(4624,4625)
$filter = @{LogName='Security'; Id=$ids; StartTime=(Get-Date).AddDays(-1)}
Get-WinEvent -FilterHashtable $filter | Select-Object TimeCreated, Id, Message

Step 5: Extract useful fields from Message

The Message field contains free text. For reports, extract values like AccountName or IP with simple regular expressions.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} |
ForEach-Object {
  $msg = $_.Message
  $account = ($msg -match 'Account Name:\s+(\S+)' ) ? $matches[1] : ''
  $ip = ($msg -match 'Source Network Address:\s+(\S+)' ) ? $matches[1] : ''
  [PSCustomObject]@{
    TimeCreated = $_.TimeCreated
    Id = $_.Id
    Account = $account
    SourceIP = $ip
  }
} | Format-Table -AutoSize

Step 6: Export to CSV

After building clean objects, export to CSV for analysis in Excel or for storage. Choose a path with write permissions.

$out = 'C:\Temp\SecurityEvents.csv'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=@(4624,4625); StartTime=(Get-Date).AddDays(-7)} |
ForEach-Object {
  $msg = $_.Message
  $account = ($msg -match 'Account Name:\s+(\S+)' ) ? $matches[1] : ''
  $ip = ($msg -match 'Source Network Address:\s+(\S+)' ) ? $matches[1] : ''
  [PSCustomObject]@{
    TimeCreated = $_.TimeCreated
    Id = $_.Id
    Account = $account
    SourceIP = $ip
  }
} | Export-Csv -Path $out -NoTypeInformation -Encoding UTF8
Write-Host "Exportado para $out"

Step 7: Export to XML or raw file

To archive the full event structure, export the entire event in XML format. This preserves all fields and is useful for ingestion by SIEM tools.

$xmlOut = 'C:\Temp\SecurityEvents.xml'
Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=(Get-Date).AddDays(-1)} |
Select-Object -First 100 | ForEach-Object { $_.ToXml() } | Out-File -FilePath $xmlOut -Encoding UTF8
Write-Host "XML guardado em $xmlOut"

Step 8: Schedule automatic export (optional)

If you need regular reports, save the script and create a Task Scheduler task that runs PowerShell with the file. Make sure to run with credentials that have access to the Security log.

powershell -ExecutionPolicy Bypass -File C:\Scripts\ExportSecurityEvents.ps1

Verify the result

Open the CSV in Excel or the XML in an editor to confirm the events were exported. Check the number of rows, the timestamps and whether the Account/SourceIP fields are populated. If there are no results, confirm permissions and the time range used.

Conclusion

Exporting Security events in PowerShell lets you monitor authentications and suspicious activity and feed SIEMs or reports. To go further, try filtering by more specific EventData, integrate with Send-MailMessage for alerts or send to a REST endpoint. Tip: start by testing small filters (1 day, few Event IDs) to avoid large data dumps — which event do you want to analyze first?