---

Get-WinEvent -LogName System -MaxEvents 30 |
    Where-Object { $_.ProviderName -match "Schannel|TerminalServices" } |
    Format-List TimeCreated, Id, LevelDisplayName, Message