function Get-UserCmdHistory{
    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True,Position=1)]
        $samaccountname,
        [Parameter(Mandatory,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True,Position=1)]
        [string[]]$Computer
    )
    
    begin{
        Write-Host "Collecting Logs from $Computer. This take long time..." -ForegroundColor Yellow
        $log = Get-WmiObject -query "SELECT * FROM Win32_NTLogEvent WHERE Logfile= 'Security' AND EventCode= '4688'" -ComputerName $Computer -ErrorAction SilentlyContinue
    }

    process {
        Write-Host "Processing Logs . This will take time...." -ForegroundColor Yellow
        $object = foreach ($l in $log){
            if($samaccountname){
                if($l.InsertionStrings[1] -eq $SamAccountName){
                    [pscustomobject]@{
                        DateTime = [System.Management.ManagementDateTimeConverter]::ToDateTime($l.TimeGenerated)
                        AccountName = $l.InsertionStrings[1]
                        CommandLine = $l.InsertionStrings[8]
                    }
                }
            }
            else{
                [pscustomobject]@{
                        DateTime = [System.Management.ManagementDateTimeConverter]::ToDateTime($l.TimeGenerated)
                        AccountName = $l.InsertionStrings[1]
                        CommandLine = $l.InsertionStrings[8]
                 }
            }
        }
        $object | Sort-Object -Property datetime 
    }
    end{
    }
}