---

PS C:\Windows\system32> $since = (Get-Date).AddHours(-4)

foreach ($log in @('Application','Directory Service')) {
    Write-Host "`n===== $log =====" -ForegroundColor Cyan

    Get-WinEvent -FilterHashtable @{
        LogName   = $log
        StartTime = $since
        Level     = 2,3
    } -ErrorAction SilentlyContinue |
    Select-Object -First 30 TimeCreated,Id,ProviderName,Message |
    Format-List
}

Write-Host "`n===== USER CREATION EVENTS =====" -ForegroundColor Cyan

Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    StartTime = $since
    Id        = 4720,4738
} -ErrorAction SilentlyContinue |
Where-Object {
    $_.Message -match 'Cheridnichenko|Alchevskaya|Чередниченко'
} |
Select-Object TimeCreated,Id,Message |
Format-List

===== Application =====

===== Directory Service =====


TimeCreated  : 11/2/2026 7:52:47 PM
Id           : 2089
ProviderName : Microsoft-Windows-ActiveDirectory_DomainService
Message      : This directory partition has not been backed up since at least the following number of days. 
                
               Directory partition: 
               DC=ForestDnsZones,DC=sys,DC=clz,DC=ru 
                
               'Backup latency interval' (days): 
               90 
                
               It is recommended that you take a backup as often as possible to recover from accidental loss of data. However if you haven't taken a 
               backup since at least the 'backup latency interval' number of days, this message will be logged every day until a backup is taken. You 
               can take a backup of any replica that holds this partition. 
                
               By default the 'Backup latency interval' is set to half the 'Tombstone Lifetime Interval'. If you want to change the default 'Backup 
               latency interval', you could do so by adding the following registry key. 
                
               'Backup latency interval' (days) registry key: 
               System\CurrentControlSet\Services\NTDS\Parameters\Backup Latency Threshold (days) 
               

TimeCreated  : 11/2/2026 7:52:47 PM
Id           : 2089
ProviderName : Microsoft-Windows-ActiveDirectory_DomainService
Message      : This directory partition has not been backed up since at least the following number of days. 
                
               Directory partition: 
               DC=DomainDnsZones,DC=sys,DC=clz,DC=ru 
                
               'Backup latency interval' (days): 
               90 
                
               It is recommended that you take a backup as often as possible to recover from accidental loss of data. However if you haven't taken a 
               backup since at least the 'backup latency interval' number of days, this message will be logged every day until a backup is taken. You 
               can take a backup of any replica that holds this partition. 
                
               By default the 'Backup latency interval' is set to half the 'Tombstone Lifetime Interval'. If you want to change the default 'Backup 
               latency interval', you could do so by adding the following registry key. 
                
               'Backup latency interval' (days) registry key: 
               System\CurrentControlSet\Services\NTDS\Parameters\Backup Latency Threshold (days) 
               

TimeCreated  : 11/2/2026 7:52:47 PM
Id           : 2089
ProviderName : Microsoft-Windows-ActiveDirectory_DomainService
Message      : This directory partition has not been backed up since at least the following number of days. 
                
               Directory partition: 
               CN=Schema,CN=Configuration,DC=sys,DC=clz,DC=ru 
                
               'Backup latency interval' (days): 
               90 
                
               It is recommended that you take a backup as often as possible to recover from accidental loss of data. However if you haven't taken a 
               backup since at least the 'backup latency interval' number of days, this message will be logged every day until a backup is taken. You 
               can take a backup of any replica that holds this partition. 
                
               By default the 'Backup latency interval' is set to half the 'Tombstone Lifetime Interval'. If you want to change the default 'Backup 
               latency interval', you could do so by adding the following registry key. 
                
               'Backup latency interval' (days) registry key: 
               System\CurrentControlSet\Services\NTDS\Parameters\Backup Latency Threshold (days) 
               

TimeCreated  : 11/2/2026 7:52:47 PM
Id           : 2089
ProviderName : Microsoft-Windows-ActiveDirectory_DomainService
Message      : This directory partition has not been backed up since at least the following number of days. 
                
               Directory partition: 
               CN=Configuration,DC=sys,DC=clz,DC=ru 
                
               'Backup latency interval' (days): 
               90 
                
               It is recommended that you take a backup as often as possible to recover from accidental loss of data. However if you haven't taken a 
               backup since at least the 'backup latency interval' number of days, this message will be logged every day until a backup is taken. You 
               can take a backup of any replica that holds this partition. 
                
               By default the 'Backup latency interval' is set to half the 'Tombstone Lifetime Interval'. If you want to change the default 'Backup 
               latency interval', you could do so by adding the following registry key. 
                
               'Backup latency interval' (days) registry key: 
               System\CurrentControlSet\Services\NTDS\Parameters\Backup Latency Threshold (days) 
               

TimeCreated  : 11/2/2026 7:52:47 PM
Id           : 2089
ProviderName : Microsoft-Windows-ActiveDirectory_DomainService
Message      : This directory partition has not been backed up since at least the following number of days. 
                
               Directory partition: 
               DC=sys,DC=clz,DC=ru 
                
               'Backup latency interval' (days): 
               90 
                
               It is recommended that you take a backup as often as possible to recover from accidental loss of data. However if you haven't taken a 
               backup since at least the 'backup latency interval' number of days, this message will be logged every day until a backup is taken. You 
               can take a backup of any replica that holds this partition. 
                
               By default the 'Backup latency interval' is set to half the 'Tombstone Lifetime Interval'. If you want to change the default 'Backup 
               latency interval', you could do so by adding the following registry key. 
                
               'Backup latency interval' (days) registry key: 
               System\CurrentControlSet\Services\NTDS\Parameters\Backup Latency Threshold (days) 
               




===== USER CREATION EVENTS =====

PS C:\Windows\system32>