---

$since = (Get-Date).AddHours(-4)

foreach ($log in @('Application','Directory Service')) {
    Write-Host "`n===== $log =====" -ForegroundColor Cyan

    Get-WinEvent -FilterHashtable @{
        LogName   = $log
        StartTime = $since
        Level     = 2,3
    } -ErrorAction SilentlyContinue |
    Select-Object -First 30 TimeCreated,Id,ProviderName,Message |
    Format-List
}

Write-Host "`n===== USER CREATION EVENTS =====" -ForegroundColor Cyan

Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    StartTime = $since
    Id        = 4720,4738
} -ErrorAction SilentlyContinue |
Where-Object {
    $_.Message -match 'Cheridnichenko|Alchevskaya|Чередниченко'
} |
Select-Object TimeCreated,Id,Message |
Format-List