View difference between Paste ID: QL31piK7 and ESnh1d2D

 $Logs=Get-eventlog -logname "Security" -Instanceid 4663|Sort-Object -Property TimeCreated
 $temp="" | Select AccountName,AccountDomain,PathName,Action,TimeWritten
 $check = 0
 $Result = Foreach($l in $Logs)
 {
     $re = "" | Select AccountName,AccountDomain,PathName,Action,TimeWritten
     $split = $l.Message -split "`n"
     [string]$Act = $split[19].Replace("`t","")
 
 
     # Truong hop Rename
     if ($check -eq 1 -And $Act -like "*%%4417*")
     {
         $temp.Action = "RENAME"
         $temp
         $check = 0
     }
     elseif($check -eq 1 -And $Act -notlike "*%%4417*")
     {
         $temp
         $check = 0
     }
 
     #Truong hop DELETE
     if ($Act -like "*%%1537*")
     {
         $re.AccountName = $split[4]
         $re.AccountDomain = $split[5]
         $re.PathName = $split[11]
         $re.Action = "DELETE"
         $re.TimeWritten = $l.TimeWritten
         $check = 1
         $temp = $re
     }
 
     #Truong hop Create or Modify
     if ($Act -like "*%%4417*")
     {
         $re.AccountName = $split[4]
         $re.AccountDomain = $split[5]
         $re.PathName = $split[11]
         $re.Action = "CREATE/MODIFY"
         $re.TimeWritten = $l.TimeWritten
         $re
     }
 }
 if($Result -eq $null)
 {
     Write-host "No matches found"
     exit
 }
 
 $Result|Export-csv E:\test1.csv
 Write-host "Done!"