title: WEVTUtil export certain event
body: <p>I want to export only event id 4624 from Security</p>
  
  <p>Code below exports all event from security (i want only 4624);</p>
  
  <pre><code>WEVTUtil query-events Security /rd:true /format:text &gt; %~dp0Logins.txt /q:"&lt;EventID&gt;4624&lt;/EventID&gt;"
  </code></pre>
  
  <p>When all 4624 events exported i want filter only events with:</p>
  
  <pre><code>&lt;Data Name='LogonProcessName'&gt;User32 &lt;/Data&gt;
  </code></pre>
  
  <p>This will be RDP logs with IP, because logs in "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" dont have IP (only username) :( I heard this is because RDP connection is TLS secured...</p>