Howto FilterHashtable with multi condition

154 Views Asked by At

Need help to filter eventID and processName to get windows event via powershell.

I'm using "get-winevent -FilterHashtable @{Logname='Security';ID=4688 ; 'ParentProcessName'='OAW' ", It doen't work.

I need ID=4688 and ProcessName='OAW'

ProcessName is some application like "c:\xxx\xxx\xxx\abcOAWxxx.exe"

Thanks.

0

There are 0 best solutions below