Improve EventViewerX history reliability and impact analysis

[PrzemyslawKlys]

Summary

• Repair ForwardedEvents and portable EVTX checkpoint continuation, preserve a valid store snapshot when restore rollback fails, and make development module imports reliable across PowerShell runtimes.
• Add bounded stored history reads through Get-EVXStoredEvent and evx query --store --stream. Schema and rows use one read snapshot, and result limits report incomplete output.
• Add Get-EVXKerberosImpact and evx kerberos-impact to group KDC RC4 audit and enforcement evidence by controller, account, service, and issue. Partial collection remains visibly incomplete.
• Reduce repeated XML work for exact System event and record ID selectors in the portable EVTX reader.
• Update the migration and command documentation and prepare the 4.0.1 module and library source versions.

Examples

Get-EVXStoredEvent -Path C:\Data\events.db -Type ActiveDirectoryAuthentication -MaxEvents 1000
Get-EVXKerberosImpact -FromStore C:\Data\events.db

evx query --store events.db --stream
evx kerberos-impact --store events.db

Release state

This PR prepares the 4.0.1 source and package inputs. Public PowerShell Gallery, NuGet, and CLI distribution remain separate release steps.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T17:34:36.804906Z	210790b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c7a24acee1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f1ef84ed91

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5400e33d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".