An end anchor requires a regular-expression match to reach the end of the input string. In a pattern such as WIN[\W\w]+TM[234][0-9]\$, the final backslash makes the dollar sign literal; without it, $ would act as the end anchor. section 21.4
Find selected computer-account logons
Filter Security events for ID 4624, then match account names beginning with WIN and ending in TM20$ through TM40$. The pattern is useful when the account name must finish at a specific boundary rather than merely contain the same characters. section 21.4
PS C:\> get-eventlog -LogName security | where { $_.eventid -eq 4624 } |
select -ExpandProperty message | select-string -pattern
"WIN[\W\w]+TM[234][0-9]\$"
Run the PowerShell pipeline to apply the pattern to expanded Security event messages. section 21.4
