I am working on a Event Log XML query via PowerShell to collect the logoff events for a manually specified time range in the Security logs. I have the PowerShell code working...just having issues with the XML Query and the results its returning. 

So far, this is my code:

<QueryList>
   <Query Id="0" Path="Security">
    <Select Path="Security"> 
	 *[EventData[Data[@Name='LogonType'] and (Data ='3')]] 
	 and
	 *[EventData[Data[@Name='TargetUserName'] != 'ComputerA$']]
	 and
	 *[EventData[Data[@Name='TargetUserName'] != 'ComputerB$']]
	 and 
	 *[EventData[Data[@Name='TargetUserName'] != 'ComputerC$']]
	 and 
	 *[EventData[Data[@Name='TargetUserName'] != 'ComputerD$']]
	 and 
	 *[EventData[Data[@Name='TargetUserName'] != 'ComputerE$']]
	 and 
	 *[EventData[Data[@Name='TargetUserName'] != 'ComputerF$']]
	 and 
     *[System[(EventID='4634')]] 
    </Select>
  </Query>
</QueryList>

The idea is to query any Event ID of 4634 (Logoff) with the LogonType of 3. I need to exclude a few servers and usernames from the results as they are the Solarwinds monitoring service accounts, etc. 

When I have Computer A - E in the XML query, the query works as expected. When I add Computer F to refine the results further, the query goes crazy and starts returning results for EventID 4624, 4634, 4672 and has results that include TargetUserName of the ones I excluded in the XML statement above. 

Why does adding ComputerF to the XML list, cause the query to not function properly? Am I hitting some limitation in the XML filter?

Hi Mabrito,

Please try to use the "Suppress Path" in xml filter to exclude some situation.

A example is for your reference, filter event 4624 except the TargetUserSid attribute is S-1-5-18:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4624)]]</Select>
    <Suppress Path="Security">*[EventData[Data[@Name="TargetUserSid"] = "S-1-5-18"]]</Suppress>
  </Query>
</QueryList>

For more detailed information about suppress path, please refer to this article:

https://msdn.microsoft.com/en-us/library/windows/desktop/dd996910(v=vs.85).aspx

If there is anything else regarding this issue, please feel free to post back.

If you have any feedback on our support, please click here.

Best Regards,

Anna Wang

TechNet Community Support