Sign in
Microsoft.com
 
Microsoft
 
 
 

none
Eventviewer related questions RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello,

    I have this question:

    _________________________

    I have made a custom view in Eventviewer with a modified XML file. I get hits on SA_account using the query with != it works with = 

    Here is my XML

    <QueryList>
      <Query Id="0" Path="Security">
        <Select Path="Security">
    *[EventData[Data[@Name='TargetUserName'] and (Data!='SA_account')]]
    and
    *[System[(EventID='4722')]]
    </Select>
      </Query>
    </QueryList>
    How can I solve this issue?

    ________________________

    What forum kan I use?

    Kind regards,

    Erwin 

    Friday, February 21, 2020 7:33 AM
    |

Answers

All replies