Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' Id = 17,21,22,41,42 } -MaxEvents 40 | Select-Object TimeCreated, Id, Message | Format-List