Hi,
i have got wired situation:
XLM filter:
*[System[(EventID=4624)]] and *[EventData[Data[@Name='subjectDomainName'] and (Data='Domain')]]
do not work, but :
*[System[(EventID=4624)]] and *[EventData[Data[@Name='subjectDomainName']='Domain']]
working. this is wired because filtering
*[EventData[Data[@Name='targetusername'] and (Data='administrator')]]
is OK. wtf?
whole working filter:
*[System[(EventID=4624)]] and *[EventData[Data[@Name='SubjectDomainName']='XXX']] and *[EventData[Data[@Name='targetusername'] and (Data='administrator')]] and *[EventData[Data[@Name='targetDomainName'] and (Data='XXX')]]
and not workin:
*[System[(EventID=4624)]] and *[EventData[Data[@Name='SubjectDomainName'] and (Data ='XXX')]] and *[EventData[Data[@Name='targetusername'] and (Data='administrator')]] and *[EventData[Data[@Name='targetDomainName'] and (Data='XXX')]]why is that or maybe i do something wrong?
tnx