I know it’s an often asked question, but all the methods that i find are not satisfying.

This is the problem:

Measure-Command {Get-EventLog -LogName Security -InstanceId 4624} | Select-Object -ExpandProperty TotalSeconds

It takes 1.3 seconds.

Measure-Command {Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624}} | Select-Object -ExpandProperty TotalSeconds

It takes 38.5 seconds.

When i try all the recommendations i found, its alwas the same. This methods need the same long time:

Measure-Command {Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 1000} | Select-Object -ExpandProperty TotalSeconds
Measure-Command {Get-WinEvent -FilterHashtable @{ProviderName='Microsoft-Windows-Security-Auditing'; Id=4624} -MaxEvents 1000} | Select-Object -ExpandProperty TotalSeconds
Measure-Command {Get-WinEvent -LogName 'Security' -MaxEvents 1000 | Where-Object {$_.Id -eq 4624}} | Select-Object -ExpandProperty TotalSeconds
Measure-Command {Get-WinEvent -ProviderName 'Microsoft-Windows-Security-Auditing' -MaxEvents 1000 | Where-Object {$_.Id -eq 4624}} | Select-Object -ExpandProperty TotalSeconds
Measure-Command {Get-WinEvent -LogName 'Security' -FilterXPath '*[System[EventID=4624]]' -MaxEvents 1000} | Select-Object -ExpandProperty TotalSeconds

2.8 seconds.

Measure-Command {Get-EventLog -LogName Security -InstanceId 4624 -Newest 1000} | Select-Object -ExpandProperty TotalSeconds

0.5 seconds.

The difference is bigger, when searching the whole logs.

So my question, is there a faster method using Get-WinEvent?
Maybe there is and i don’t know it.

Thanks!