Parsing the message field in security event.code 4624

[Badger]

This post is related to parsing these messages, but it's not the approach I would recommend. This post may be a better way of doing it.