Q&A for Work

Setup a private space for you and your coworkers to ask questions and share information. Learn more about Teams

I'm trying to read the event log for a security audit for all users except two, but is it possible to do that with the -notlike operator?

It's something like that:

Get-EventLog -LogName Security | where {$_.UserName -notlike @("*user1","*user2")}
I have it working for a single user, like:
Get-EventLog -LogName Security | where {$_.UserName -notlike "*user1"}
V2 at least contains the -username parameter that takes a string[], and supports globbing.
V1 you want to expand your test like so:
Get-EventLog Security | ?{$_.UserName -notlike "user1" -and $_.UserName -notlike "*user2"}
Or you could use "-notcontains" on the inline array but this would only work if you can do exact matching on the usernames.
... | ?{@("user1","user2") -notcontains $_.username}
                You can also reference the list of usernames to filter out via a variable:  ?{$users -notcontains $_.username}
                    – JasonMArcher
                May 11 '09 at 22:09
I think Peter has the right idea.  I would use a regular expression for this along with the -notmatch operator.
Get-EventLog Security | ?{$_.Username -notmatch '^user1$|^.*user$'}
In order to support "matches any of ..." scenarios, I created a function that is pretty easy to read. My version has a lot more to it because its a PowerShell 2.0 cmdlet but the version I'm pasting below should work in 1.0 and has no frills.
You call it like so:
Get-Process | Where-Match Company -Like '*VMWare*','*Microsoft*'
Get-Process | Where-Match Company -Regex '^Microsoft.*'
filter Where-Match($Selector,[String[]]$Like,[String[]]$Regex) {
    if ($Selector -is [String]) { $Value = $_.$Selector }
    elseif ($Selector -is [ScriptBlock]) { $Value = &$Selector }
    else { throw 'Selector must be a ScriptBlock or property name' }
    if ($Like.Length) {
        foreach ($Pattern in $Like) {
            if ($Value -like $Pattern) { return $_ }
    if ($Regex.Length) {
        foreach ($Pattern in $Regex) {
            if ($Value -match $Pattern) { return $_ }
filter Where-NotMatch($Selector,[String[]]$Like,[String[]]$Regex) {
    if ($Selector -is [String]) { $Value = $_.$Selector }
    elseif ($Selector -is [ScriptBlock]) { $Value = &$Selector }
    else { throw 'Selector must be a ScriptBlock or property name' }
    if ($Like.Length) {
        foreach ($Pattern in $Like) {
            if ($Value -like $Pattern) { return }
    if ($Regex.Length) {
        foreach ($Pattern in $Regex) {
            if ($Value -match $Pattern) { return }
    return $_
Easiest way I find for multiple searches is to pipe them all (probably heavier CPU use) but for your example user:
Get-EventLog -LogName Security | where {$_.UserName -notlike "*user1"} |  where {$_.UserName -notlike "*user2"}
Scenario:
List all computers beginning with XX1 but not names where 4th character is L or P
Get-ADComputer -Filter {(name -like "XX1*")} | Select Name | Where {($_.name -notlike "XX1L*" -and $_.name -notlike "XX1P*")}
You can also count them by enclosing the above script in parens and adding a .count method like so:
(Get-ADComputer -Filter {(name -like "XX1*")} | Select Name | Where {($_.name -notlike "XX1L*" -and $_.name -notlike "XX1P*")}).count
$listOfUsernames = @("user1", "user2", "etc", "and so on")
Get-EventLog -LogName Security | 
    where { $_.Username -notmatch (
        '(' + [string]::Join(')|(', $listOfUsernames) + ')') }
It's a little crazy I'll grant you, and it fails to escape the usernames (in the unprobable case a username uses a Regex escape character like '\' or '(' ), but it works.
As "slipsec" mentioned above, use -notcontains if possible.
Yep, but you have to put the array first in the expression:
... | where { @("user1","user2") -notlike $_.username }
-Oisin
                I tried, but it didn't have the excepted results.. check below if I did anything stupid, because both users appeared, along with everyone else:  Get-EventLog -LogName Security | where {@("*user1", "*user2") -notlike $_.UserName} | Format-Table -Property EventID,Category,EntryType,TimeGenerated,UserName
                    – Pascal
                May 11 '09 at 16:33
                Right, this wont work because no matter what the username is, it will also be notlike one of the items in the list.  So the condition is always true.  These array comparisons are always OR and not AND.
                    – JasonMArcher
                May 11 '09 at 22:08
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
                    
Related
                        
2460Determine installed PowerShell version
635How to run a PowerShell script
1505PowerShell says “execution of scripts is disabled on this system.”
1How to check if a user is in a particular group from a particular OU in Powershell
900How do you comment out code in PowerShell?
490How do I concatenate strings and variables in PowerShell?
2Writing to the Windows Security Log
2Get-eventlog: How to get all Logs (Application, System, Security, etc) using powershell
0Get the last 10 events i Eventlog(Application, Secuirty, System) in powershell
0Run powershell script as logged in user
site design / logo © 2019 Stack Exchange Inc; user contributions licensed under cc by-sa 3.0
                            with attribution required.
                    rev 2019.8.27.34719