windows security events

 Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} | Group-Object {$_.pRoperties[5].value} | Select-Object Count,Name | Sort count -Des
cending