---

$RDPAuths = Get-WinEvent -ComputerName $Broker -LogName 'Microsoft-Windows-TerminalServices-SessionBroker/Operational' -FilterXPath '<QueryList><Query Id="0"><Select>*[System[EventID=801]]</Select></Query></QueryList>'
[xml[]]$xml=$RDPAuths|Foreach{$_.ToXml()}
$EventData = Foreach ($event in $xml.Event)
{ New-Object PSObject -Property @{
    TimeCreated = (Get-Date ($event.System.TimeCreated.SystemTime) -Format 'yyyy-MM-dd HH:mm:ss')
    User = $event.UserData.EventXML.Param1
    Domain = $event.UserData.EventXML.Param2
    Client = $event.UserData.EventXML.Param3
    }
}