A personal repository of technical notes. - CSC

Windows Event Viewer Filter XML

Windows 7 XML Sample

       <Query Id="0" Path="Security">
              <Select Path="Security">
                           or EventID=4625
                           or EventID=4634
                                  Data[@Name='TargetDomainName'] = 'Abcd'
                                  or Data[@Name='AccountDomain'] = 'XYZ'
                                  Data[@Name='TargetUserName'] != 'U123'


"Event Viewer - Wikipedia, the free encyclopedia." Wikipedia, the free encyclopedia. N.p., n.d. Web. 19 Oct. 2011.

"Windows Event Viewer CUSTOM XML FILTER | Jamin Quimby Installation & Development Notes." Jamin Quimby .com | Jamin Quimby Installation & Development Notes. N.p., n.d. Web. 19 Oct. 2011.

"Event Log Hell (finding user logon & logoff) - Ars Technica OpenForum." Ars Technica. N.p., n.d. Web. 19 Oct. 2011.