$Logs=Get-eventlog -logname "Security" -Instanceid 4663|Sort-Object -Property TimeCreated
$temp="" | Select AccountName,AccountDomain,PathName,Action,TimeWritten
$check = 0
$Result = Foreach($l in $Logs)
{
    $re = "" | Select AccountName,AccountDomain,PathName,Action,TimeWritten
    $split = $l.Message -split "`n"
    [string]$Act = $split[19].Replace("`t","")


    # Truong hop Rename
    if ($check -eq 1 -And $Act -like "*%%4417*")
    {
        $temp.Action = "RENAME"
        $temp
        $check = 0
    }
    elseif($check -eq 1 -And $Act -notlike "*%%4417*")
    {
        $temp
        $check = 0
    }

    #Truong hop DELETE
    if ($Act -like "*%%1537*")
    {
        $re.AccountName = $split[4]
        $re.AccountDomain = $split[5]
        $re.PathName = $split[11]
        $re.Action = "DELETE"
        $re.TimeWritten = $l.TimeWritten
        $check = 1
        $temp = $re
    }

    #Truong hop Create or Modify
    if ($Act -like "*%%4417*")
    {
        $re.AccountName = $split[4]
        $re.AccountDomain = $split[5]
        $re.PathName = $split[11]
        $re.Action = "CREATE/MODIFY"
        $re.TimeWritten = $l.TimeWritten
        $re
    }
}
if($Result -eq $null)
{
    Write-host "No matches found"
    exit
}

$Result|Export-csv E:\test1.csv
Write-host "Done!"