Несоответствие между журналом событий, взятым от Powershell и со Средством просмотра журнала событий
1 ответ
On Windows Vista and later you should use Get-WinEvent as it can read the extended event data more of the time
For more detail about this command you can use -? symbol. or Refer to this article http://technet.microsoft.com/en-us/library/hh849682.aspx
2