2/14/2023 0 Comments Aritech cs350 view event logIf you want to see events that are only about user ‘test9’, you need a Custom View and an XML filter.Ĭustom Views using XML filtering are a powerful way to drill through event logs and only display the information you need. Sample 4663 events for users ‘test5’ and ‘test9’ You can see the account of the user, and what object they were accessing. 4663 events appear when auditing users accessing objects. You can choose multiple events that match your criteria as well.īasic filter for Event 4660 & 4663 of the security event logsĪ real limitation to this type of filtering is the data inside each event can be very different. You can filter by the event level, the source of the event, the Event ID, certain keywords, and the originating user/computer.īasic Filter for Event 4663 of the security event logs Starting in Windows Vista/2008, you have the ability to modify the XML query used to generate Custom Views.īasic filtering allows you to display events that meet certain criteria. The standard GUI allows some basic filtering, but you have the ability to drill down further to get the most relevant data. First published on TechNet on Sep 26, 2011
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |