Filter events using XML Filtering - Suppress Logon Type = '0'

0

Im using a custom filter view show attempted local failed logins.

This works great apart from it still shows failed logins from Logon Type '0'

Ive tried suprressing these events and they still show.

Here is my filter

<QueryList>
  <Query Id="0" Path="ForwardedEvents">
    <Select Path="ForwardedEvents">
      *[
        EventData[Data[@Name='LogonType']='3']
        and
        EventData[Data[@Name="SubjectUserSid"] = "S-1-0-0"]
        and
        System[(EventID='4625')]
      ] or
     *[
        EventData[Data[@Name='LogonType']='7']
        and
        EventData[Data[@Name="SubjectUserSid"] = "S-1-0-0"]
        and
        System[(EventID='4625')]
      ]

    </Select>
    <Suppress Path="ForwardedEvents">*[ EventData[Data[@Name='LogonType']='0']]</Suppress>
  </Query>
</QueryList>

As you can see i want the failed events for logontype 3 and 7 but not the 0 logontypes. The suppress path fails to hide them.

Here is an example of an event that i want to suppress

An account failed to log on.

Subject:
    Security ID:        S-1-0-0
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         0

Account For Which Logon Failed:
    Security ID:        S-1-0-0
    Account Name:       WORKGROUP
    Account Domain:     0xc000006d

Just checked the xml for this event and logontype is set to 3 , but why does it display 0?

xml
events
event-handling
event-id
asked on Stack Overflow Nov 30, 2020 by Retroisbest • edited Nov 30, 2020 by Retroisbest

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0