Untitled

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625,4771,4776} -MaxEvents 50 |
  ForEach-Object {
        $xml = [xml]$_.ToXml()
            [PSCustomObject]@{
                      TimeCreated = $_.TimeCreated
                            EventID     = $_.Id
                                  User        = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq "TargetUserName"}).'#text'
                                        IPAddress   = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq "IpAddress"}).'#text'
                                              Workstation = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq "WorkstationName"}).'#text'
                                                    FailureReason = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq "FailureReason"}).'#text'
            }
  } | Where-Object {$_.User -eq "andy"} | Format-Table -AutoSize
            }
  }