Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 6062
  • Last Modified:

Filtering event 4624 by logon type

I'm looking to find a way to filter event 4624 by logon type.  I want to only get logon type 2 and logon type 10.  Since the logon type is written in the message of the event I can't think of a way to filter on it.  The only way I've found is to dump all the 4624's to a text file via script and just search for type 2 and 10.  But I'd like to automate this if possible.
0
bigbigpig
Asked:
bigbigpig
  • 2
1 Solution
 
AnuroopsunddCommented:
In event viewer

under custom views.
Right click new view
Create Custom view

specify the even id and other details... this wll create the xml automatically
then under XML tab.. select check box edit query manually.. and change as per your requirement... below is just an example...you may have to modify for type of event (System,Security, Application.) if the line is comming multiple times...


<Select Path="S">*[System[(Level=2 or Level=10) and (EventID=4624)]]
0
 
bigbigpigAuthor Commented:
That didn't work but you got me in the right direction!  I looked in the events metadata to figure out what to query.  Here's what I used:

<Select Path="Security">*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType'] and (Data=2 or Data=10)]]</Select>

Open in new window


Thank you!
0
 
AnuroopsunddCommented:
yeah.. i should have mentioned that those where just the steps how to do..
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now