Solved

Filtering event 4624 by logon type

Posted on 2012-04-12
3
4,471 Views
Last Modified: 2012-04-12
I'm looking to find a way to filter event 4624 by logon type.  I want to only get logon type 2 and logon type 10.  Since the logon type is written in the message of the event I can't think of a way to filter on it.  The only way I've found is to dump all the 4624's to a text file via script and just search for type 2 and 10.  But I'd like to automate this if possible.
0
Comment
Question by:bigbigpig
  • 2
3 Comments
 
LVL 17

Accepted Solution

by:
Anuroopsundd earned 500 total points
ID: 37840869
In event viewer

under custom views.
Right click new view
Create Custom view

specify the even id and other details... this wll create the xml automatically
then under XML tab.. select check box edit query manually.. and change as per your requirement... below is just an example...you may have to modify for type of event (System,Security, Application.) if the line is comming multiple times...


<Select Path="S">*[System[(Level=2 or Level=10) and (EventID=4624)]]
0
 
LVL 10

Author Comment

by:bigbigpig
ID: 37841019
That didn't work but you got me in the right direction!  I looked in the events metadata to figure out what to query.  Here's what I used:

<Select Path="Security">*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType'] and (Data=2 or Data=10)]]</Select>

Open in new window


Thank you!
0
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37841024
yeah.. i should have mentioned that those where just the steps how to do..
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Utilizing an array to gracefully append to a list of EmailAddresses
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question