SecurityEvent
| where EventID == '5136'
| where AccountType == 'User' 
| summarize by Account