Hi all, Is there a way for me to hide entries from a specific user in Event Viewer on W2K3? I know I can filter so that only the entries of 1 user are showing, but how to I invert that? See all entries, except the ones made by a specific user?Regards, Evert

Hi Evert, I believe that kind of filtering cannot be done via the Event Viewer console (Filter). However, this can be easily handled using a script. Here's one: strComputer = "."Set objWMIService = GetObject("winmgmts:{(Security)}\\" & strComputer & "\root\cimv2") Set colEvents = objWMIService.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = 'System' " & _ "and User<>'FABRIKAM\\badzmanaois'") For Each objEvent in colEvents Wscript.Echo objEvent.Category & "," & objEvent.ComputerName & "," & _ objEvent.EventCode & "," & objEvent.Message & "," & _ ConvertTimeWritten(objEvent.TimeWritten) & "," & _ objEvent.Type & "," & objEvent.UserNext Function ConvertTimeWritten(TimeWritten) ConvertTimeWritten = CDate(Mid(TimeWritten, 5, 2) & "/" & _ Mid(TimeWritten, 7, 2) & "/" & Left(TimeWritten, 4) _ & " " & Mid (TimeWritten, 9, 2) & ":" & _ Mid(TimeWritten, 11, 2) & ":" & Mid(TimeWritten, _ 13, 2))End Function http://sgwindowsgroup.org/blogs/badz/archive/2010/03/22/event-viewer-ninjitsu-part-1.aspx Regards,Salvador Manaois IIIMCSE MCSA MCTS MCITP C|EH CIWA ----------------------------------------------------------------------------Bytes & Badz: http://badzmanaois.blogspot.comMy Passion: http://www.flickr.com/photos/badzmanaoisMy Scripting Blog: http://sgwindowsgroup.org/blogs/badz