title: Using wevtutil return a selected event attribute as text from a selected event record
body: <p>I am trying to use wevtutil to extract the value of a particular attribute, ObjectName, (without tags) from the most recent audit event of a specific ID, 4663. I then want to place that in an environment variable for use in a batch file which is triggered by occurrences of 4663. I have copied in the xml for the event below.</p>
  
  <p>I have got to the point of being able to select the event and output the XML using this syntax:</p>
  
  <pre><code>C:\Users\Mike&gt;wevtutil qe security /q:"*[System [(EventID=4663)]]" /c:1 /rd:true
  </code></pre>
  
  <p>But I cannot work out how to retrieve just one attribute from within the event XML that results. Is it even possible? Xpath appears to provide the syntax, but does wevtutil support it?</p>
  
  <p>I'd prefer to do it in one stage, but I understand wevtutil can output to a file so I guess you could then process that in some way. </p>
  
  <p>Obviously if there were a better utility than wevtutil to do this I could use that.</p>
  
  <p>Many thanks to anyone who can help.</p>
  
  <p>Mike</p>
  
  <p><strong>Event XML</strong></p>
  
  <pre><code>&lt;Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"&gt;
  &lt;System&gt;
  &lt;Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/&gt;
  &lt;EventID&gt;4663&lt;/EventID&gt;
  &lt;Version&gt;0&lt;/Version&gt;
  &lt;Level&gt;0&lt;/Level&gt;
  &lt;Task&gt;12800&lt;/Task&gt;
  &lt;Opcode&gt;0&lt;/Opcode&gt;
  &lt;Keywords&gt;0x8020000000000000&lt;/Keywords&gt;
  &lt;TimeCreated SystemTime="2013-12-07T16:50:28.582540600Z"/&gt;
  &lt;EventRecordID&gt;2637347&lt;/EventRecordID&gt;
  &lt;Correlation/&gt;
  &lt;Execution ProcessID="4" ThreadID="64"/&gt;
  &lt;Channel&gt;Security&lt;/Channel&gt;
  &lt;Computer&gt;Dell-8300-PC&lt;/Computer&gt;
  &lt;Security/&gt;
  &lt;/System&gt;
  &lt;EventData&gt;
  &lt;Data Name="SubjectUserSid"&gt;S-1-5-21-1054466239-2335366426-2448288976-1001&lt;/Data&gt;
  &lt;Data Name="SubjectUserName"&gt;Mike&lt;/Data&gt;
  &lt;Data Name="SubjectDomainName"&gt;Dell-8300-PC&lt;/Data&gt;
  &lt;Data Name="SubjectLogonId"&gt;0x4149a&lt;/Data&gt;
  &lt;Data Name="ObjectServer"&gt;Security&lt;/Data&gt;
  &lt;Data Name="ObjectType"&gt;File&lt;/Data&gt;
  &lt;Data Name="ObjectName"&gt;D:\Mike's data\My Documents\fred&lt;/Data&gt;
  &lt;Data Name="HandleId"&gt;0x12a74&lt;/Data&gt;
  &lt;Data Name="AccessList"&gt;%%4418&lt;/Data&gt;
  &lt;Data Name="AccessMask"&gt;0x4&lt;/Data&gt;
  &lt;Data Name="ProcessId"&gt;0x1048&lt;/Data&gt;
  &lt;Data Name="ProcessName"&gt;C:\Windows\explorer.exe&lt;/Data&gt;
  &lt;/EventData&gt;
  &lt;/Event&gt;
  </code></pre>