Windows Event IDs

Event ID related to Time / TimeZone Change 4616, 35, 31, 6013, 1

System Restart Related Event ID: 1074, 13, 109, 20

Login related event ID: 4624, 4625, 4634

Security Log unrelated log filter: -4703,-5158, -5156, -5154, -4622

Event ID	Meaning	Source	Folder
1074	The process C:\Windows\System32\RuntimeBroker.exe (alex-bridger) has initiated the restart of computer	User32	System
13	The operating system is shutting down at system time	Kernel-General	System
109	The kernel power manager has initiated a shutdown transition	Kernel-Power	System
20	The last shutdown's success status was true. The last boot's success status was true.	Kernel-Boot	System
4624	Successful Login	Microsoft Windows security auditing	Security
4625	Logon Failure	Microsoft Windows security auditing	Security

可以使用如下命令批量检查Windows Event Log：

Get-EventLog -LogName System `
| Where-Object { $_.EventID -in 6005, 6006, 6008, 1074, 41, 13, 109, 20 } `
| Select-Object -First 10 Index, TimeGenerated, EntryType, EventID, Message | Format-Table -AutoSize -Wrap

 

Reference: 

Windows Security Log Event ID 4625 - An account failed to log on