Quantcast
Channel: XML, System.Xml, MSXML and XmlLite forum
Viewing all articles
Browse latest Browse all 935

Event log filter to exclude a specific Target Account Name

$
0
0

I'm currently using the following XPath filter to show logs for user account creations and deletions:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4720 or EventID=4726)]]</Select>
  </Query>
</QueryList>

Is there a way for me to exclude a Target Account Username (not a Subject Account Username)?  Basically, I want to see events when user accounts are created or deleted except for a specific user account.


Viewing all articles
Browse latest Browse all 935

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>