• Home
  • About us
  • Contact

Welcome to www.DoitFixit.com

www.doitfixit.com

  • Microsoft
  • Fortinet
  • Symantec
  • Office 365
  • Azure
  • Others

Filter Event Viewer Security Log by Account Name

December 18, 2012 By Damitha Anuradha Leave a Comment

  1. Click “Filter Current Log” on Actions menu.

  2. Click “XML” tab
  3. Select “Edit Query manually“

  4. Paste one of below query and replace “User/Description” with relevant User Name/Description.

    <QueryList>
    <Query Id=”0″ Path=”Security”>
    <Select Path=”Security”>* [EventData[Data[@Name=’subjectUsername’]=’AccountName‘]]</Select>
    </Query>
    </QueryList>

    ………………………………………………………………………………….

    <QueryList>
    <Query Id=”0″>
    <Select Path=”Security”>
    *[EventData[Data[@Name=’SubjectUserName’] and (Data=’description‘)]]
    </Select>
    </Query>
    </QueryList>

  5. Click OK

  6. To clear the filter click “Clear Filter“

More customized Queries..
http://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

LATEST ARTICLES

  • Slow Network Speed with Hyper-V Virtual Machines on Windows Server Server 2019
  • Block MS Exchange Server OWA access from Internet
  • Error 1168 – The specified product key could not be validated.
  • Unable to Enable Desktop Icons after Joining to the Domain
  • Veritas BackupExec – A backup set was created which contains no data 0xe00084b7

Copyright © 2020 · www.doitfixit.com · Log in