Exporting Windows events
To export an indexed event list for Window sessions from the command line, use the following syntax:
FindSessions /i=”InstallationName” /export=”WashEvents” /path=”folder”
For example, to export the indexed event list for the sessions associated with a specific user and save the output in the C:\Temp\Session Events
folder, you would type a command like this:
FindSessions /i=”MyInstallation” /user=”chris.howard” /export=”WashEvents” /path=”C:\Temp\Session Events”
The command generates the list of events as comma-separated values in a text file. For example:
"Time","Application","Title","Type","Desktop","Audited","Role","Ticket"
"1/29/2015 1:53:14 PM", "Windows Explorer", "Start", "Application Activate", "Default", "Y","<None>","<None>" "1/29/2015 1:53:56 PM", "DirectAuthorize System Tray", "Options", "Application Activate", "Default", "Y","<None>","<None>" ... "1/29/2015 3:00:51 PM", "Windows Explorer", "Start", "Window Activate", "LocalSQLAdmin", "Y","<None>","<None>" "1/29/2015 3:01:16 PM", "Microsoft SQL Server Management Studio Express", "Microsoft SQL Server Management Studio Express", "Application Activate", "LocalSQLAdmin", "Y","<None>","<None>" .