WMIC.exe ntevent

wmic ntevent where (message like "%logon%") list brief