none
event XML filter problem

    Question

  • Hi,

    i have got wired situation:

    XLM filter:

    *[System[(EventID=4624)]] and *[EventData[Data[@Name='subjectDomainName'] and (Data='XXX')]]

    do not work, but :

    *[System[(EventID=4624)]] and *[EventData[Data[@Name='subjectDomainName']='XXX']]

    working. this is wired because filtering

    *[EventData[Data[@Name='targetusername'] and (Data='administrator')]]

    is OK. wtf? why filtering "targetusername" is different than "subjectDomainName"

    whole working filter:

    *[System[(EventID=4624)]] and *[EventData[Data[@Name='SubjectDomainName']='XXX']] and 
    *[EventData[Data[@Name='targetusername'] and (Data='administrator')]] and *[EventData[Data[@Name='targetDomainName'] and (Data='XXX')]]

    and not workin:

    *[System[(EventID=4624)]] and *[EventData[Data[@Name='SubjectDomainName'] and (Data ='XXX')]] and 
    *[EventData[Data[@Name='targetusername'] and (Data='administrator')]] and *[EventData[Data[@Name='targetDomainName'] and (Data='XXX')]]

    why is that or maybe i do something wrong?

    i started thread http://social.technet.microsoft.com/Forums/en-US/eb887a6d-2be3-4b92-8a9c-669e2f7eca81/event-xml-filter?forum=winservergen but i was directed to xml forum.

    tnx in adv


    Voytas

    Friday, December 27, 2013 11:38 AM

All replies