Get-EventLog "Windows PowerShell" | Group-Object Eventid | Sort-Object Name Get-EventLog "Windows PowerShell" | Where-Object {$_.EventId -eq 403}
Get-EventLog System -Newest 15 | Sort-Object Eventid -Descending