Today I was asked who had made a change to one of our security groups. Back in the bad old days I would open up event viewer. Set the filter and open events one at a time.....
Today we have Powershell. This one-liner will search the security log of a DC and then search through the message body of the event to get the one you want
Get-WinEvent -ComputerName dc0x -FilterHashtable @{logname='security'; id=4757} | Where { $_.message -like ‘*Matthew L*’ -and $_.message -like '*secure-users*