I'm currently using the following XPath filter to show logs for user account creations and deletions:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=4720 or EventID=4726)]]</Select>
</Query>
</QueryList>
Is there a way for me to exclude a Target Account Username (not a Subject Account Username)? Basically, I want to see events when user accounts are created or deleted except for a specific user account.