This command helps filter SYSTEM event log entries.
get-eventlog system | where {$_.Message -match "Office" -and $_.Source -match "UmrdpService"} | format-table -wrap -autosize -property Message
