Invoke-QueryDowngrade.ps1

$hostlist = "",""

$userSearch = ""

$ErrorActionPreference = "SilentlyContinue"
                   
function Invoke-QueryDowngrade{

  $downgradeXML = @"

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
        *[System[EventID='4768']]
        and
        *[EventData[Data[@Name='TargetUserName'] != 'ANONYMOUS LOGON']]
        and
        *[EventData[Data[@Name='TargetUserName'] = '$userSearch']]
        and
        *[EventData[Data[@Name='ServiceName'] = 'krbtgt']]
        and
        *[EventData[Data[@Name='TicketEncryptionType'] = '0x17']]
        </Select>
  </Query>
</QueryList>

"@

  foreach($hostName in $hostlist){
    "==== Querying Host: $hostname ===="
    $result = Get-WinEvent -FilterXml $downgradeXML -ComputerName $hostName
    if($result){
      $result | Format-List
    }else{
      "No Result or unable to query"
    }
    
  }

}