title: EventLog & ConvertFrom-String
body: <p>i am trying to objectify the security event log by using the <code>ConvertFrom-String</code> PowerShell cmdlet, but am not able to work it out.</p>
  
  <p>First i am getting the event/s from my DC.</p>
  
  <pre><code>$events = Get-WinEvent -ComputerName $comp FilterHashtable @{logname='security';id=4727}
  </code></pre>
  
  <p>Next i define my template.</p>
  
  <p><code>$tmpl = @'
  {Event:A security-enabled global group was created.}
  Subject:
      Security ID:        S-1-5*
      {SubjectName:Account Name:      andrew}
      Account Domain:     DOMAIN
      Logon ID:       0x16D280EB
  New Group:
      Security ID:        S-1-5*
      {GroupName:Group Name:      test1}
      Group Domain:       DOMAIN
  Attributes:
      SAM Account Name:   test1
      SID History:        -
  Additional Information:
      Privileges:     -
  '@</code></p>
  
  <p>Finally i try to turn it into objects.</p>
  
  <pre><code>($events).message | ConvertFrom-String -TemplateContent $tmpl
  </code></pre>
  
  <p>But my output is only</p>
  
  <p><code>Event: A security-enabled global group was created.</code></p>
  
  <p>Instead, I want to get something like;</p>
  
  <ul>
  <li>Event: A security-enabled global group was created </li>
  <li>SubjectName: andrew </li>
  <li>GroupName: test1</li>
  </ul>
  
  <p>And i would like this to be compatible to loop through many similar events to pull out the right bits??</p>