When you have enabled appropiate security auditing you will need to search for eventID 528.
The following logparser command can be used as an alternative to Event Viewer.
logparser "Select TimeGenerated AS Date, SID From SECURITY WHERE EventID=528 ORDER BY Date DESC" -resolveSIDs:on
