Message is broken out further and requires extra massaging, that and I am formatting it for eventual Neo4j graph sexiness. #include <AutoItConstants.au3> #include<array.au3> #RequireAdmin $outfile = "test_PS_csv_failures.csv" If fileexists($outfile) then FileDelete($outfile) $iPID = run("powershell get-eventlog -logname security -Message '*An account failed to log on*' | select Index,TimeGenerated,Message | format-list" , "", @SW_HIDE , $stdout_ch