Pull Account Name from Message in Eventlog - powershell

Question

I want to pull the account name from the message property in an event log. For instance I am running the following command:

get-eventlog -computername dc-01 -logname security | ?{$_.eventid -eq "4674"} | convertto-html -property machinename,eventid,entrytype,message | out-file c:\test.html

I want to be able to pull the account name out of message but not necessary for specific users. Ideally, it would create another column named Account Name which we could sort on

Solution

Take a look at the second item of the ReplacementStrings property of each event. It contains the values embeded in the message.

get-eventlog -computername dc-01 -logname security | ?{$_.eventid -eq "4674"} | 
select machinename,eventid,@{n='AccountName';e={$_.ReplacementStrings[1]}},entrytype,message | 
convertto-html | out-file c:\test.html