---

$user  = "ivanov"                      # логин (sAMAccountName)
$start = (Get-Date).AddDays(-7)        # начало периода
$dcs   = (Get-ADDomainController -Filter *).HostName

$result = foreach ($dc in $dcs) {
    Write-Host "Опрашиваю $dc ..." -ForegroundColor Cyan
    try {
        Get-WinEvent -ComputerName $dc -ErrorAction Stop -FilterHashtable @{
            LogName   = 'Security'
            Id        = 4624, 4625, 4768, 4776
            StartTime = $start
        } | ForEach-Object {
            $d = @{}
            ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
            if ($d['TargetUserName'] -match "^$([regex]::Escape($user))(@.*)?$") {
                [pscustomobject]@{
                    Time      = $_.TimeCreated
                    EventID   = $_.Id
                    DC        = $dc
                    User      = $d['TargetUserName']
                    IP        = $d['IpAddress']
                    Host      = $d['Workstation']
                    LogonType = $d['LogonType']
                }
            }
        }
    } catch {
        Write-Host "${dc}: $($_.Exception.Message)" -ForegroundColor Red
    }
}

"Найдено событий: $(@($result).Count)"
$result | Sort-Object Time | Format-Table -AutoSize