You need to export Windows Event Logs but also need them to have the human readable format of hostnames, usernames, groups, etc.
If you export the logs from the Event Viewer the hostnames, usernames, groups and other objects are GUID's which are not useful when looking through the logs.
When exported using the WinRS client, Windows does the translations and exports the data with the human readable values.
You must be logged in with a Domain Account which has Local Administrator privileges to run the commands for exporting the appropriate Windows Event Logs.
Run the commands below.
Note: these commands only export the 500 most recent events. If you need more, increase the number following "/c:".
Remove the listener created with the winrm quickconfig command ran in Step #2 above.
In the command prompt with Administrator privileges run the command winrm delete /winrm/config/Listener?Address=*+Transport=HTTP