Im using a custom filter view show attempted local failed logins.
This works great apart from it still shows failed logins from Logon Type '0'
Ive tried suprressing these events and they still show.
Here is my filter
<QueryList>
<Query Id="0" Path="ForwardedEvents">
<Select Path="ForwardedEvents">
*[
EventData[Data[@Name='LogonType']='3']
and
EventData[Data[@Name="SubjectUserSid"] = "S-1-0-0"]
and
System[(EventID='4625')]
] or
*[
EventData[Data[@Name='LogonType']='7']
and
EventData[Data[@Name="SubjectUserSid"] = "S-1-0-0"]
and
System[(EventID='4625')]
]
</Select>
<Suppress Path="ForwardedEvents">*[ EventData[Data[@Name='LogonType']='0']]</Suppress>
</Query>
</QueryList>
As you can see i want the failed events for logontype 3 and 7 but not the 0 logontypes. The suppress path fails to hide them.
Here is an example of an event that i want to suppress
An account failed to log on.
Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 0
Account For Which Logon Failed:
Security ID: S-1-0-0
Account Name: WORKGROUP
Account Domain: 0xc000006d
Just checked the xml for this event and logontype is set to 3 , but why does it display 0?
User contributions licensed under CC BY-SA 3.0