Powershell get-winevent Syntaxfrage

Get-WinEvent -FilterXPath "*[System[(EventID=4656)] and EventData[Data[@Name = 'SubjectUsername']='mustermann']]" | ?{$_.Message -match 'Objektname:\s*D:\\Test'} | select ID,@{n="Kontoname";e={[regex]::match($_.message,'Kontoname:\s*([^\r\n]*)').Groups[1].Value}},@{n="Objektname";e={[regex]::match($_.message,'Objektname:\s*([^\r\n]*)').Groups[1].Value}}  

# -------------------------
$username = 'musterman'  
$path = 'D:\test'  
# -------------------------

if (Get-EventSubscriber -SourceIdentifier NewEventlogWatcher){Unregister-Event NewEventLogWatcher}
$logname = "Security"  
$xPathFilter = "*[System[(EventID=4656)] and EventData[Data[@Name = 'SubjectUsername']='$username']]"  
$action = {
    [xml]$xml = $Event.SourceArgs.EventRecord.toXML()
    $ns = new-Object System.Xml.XmlNamespaceManager $xml.NameTable
    $ns.AddNamespace("ns",$xml.DocumentElement.NamespaceURI)  
    $objectname = $xml.SelectSingleNode("//ns:Data[@Name='ObjectName']",$ns).innerText  
    if ($objectname -like "$path\*"){  
        write-host "User '$username' hat auf '$objectname' zugegriffen."  
        # Hier ein das gewünschte Skript ausführen 
    }
}
$query = New-Object System.Diagnostics.Eventing.Reader.EventLogQuery($logname,[System.Diagnostics.Eventing.Reader.PathType]::LogName,$xPathFilter)
$watcher = New-Object System.Diagnostics.Eventing.Reader.EventLogWatcher($query, $null, $false)
Register-ObjectEvent -InputObject $watcher -SourceIdentifier "NewEventLogWatcher" -EventName 'EventRecordWritten' -Action $action  
$watcher.Enabled = $true
while($true){
    sleep(1)
}