Little update: i missed formatting options, after adding ...-format udt -c... i get a list DOMAIN\user,,date,time. Is there any way to sort it by date because it's in the reversed order? Not from some date to now, but from now to some date and removing fields other than domain\... (because there are also services listed).