$watcher = New-Object System.Diagnostics.Eventing.Reader.EventLogWatcher("Security")
$watcher.Enabled = $true

$OnEventWritten =
{
   $e = $event.sourceEventArgs.EventRecord

   Add-Type -AssemblyName System.Windows.Forms
   $notification = New-Object System.Windows.Forms.NotifyIcon
   $notification.Icon = [System.Drawing.SystemIcons]::Warning
   $notification.Visible = $true

   if ($e.Id -eq 4625) # Nieudane logowania
   {
     $info = "Na konto ["+ $e.Properties[5].Value.ToString() + "] " +  "próbowano się zalogować z [" + $e.Properties[6].Value.ToString() + "]." + " Więcej informacji znajdziesz w dzienniku bezpieczeństwa."
     $notification.ShowBalloonTip(10000, "[Strażnik] - Wykryto nieudane logowanie!", $info, [System.Windows.Forms.ToolTipIcon]::Warning)   
   }
}

Register-ObjectEvent -InputObject $watcher -EventName EventRecordWritten -Action $OnEventWritten -SourceIdentifier SentinelNotify

#Unregister-Event -SourceIdentifier SentinelNotify