'Filter Windows Eventlog with XPath-Filter
I try to filter a windows event log for "real" interactive logon/unlock-events. For this I have written the following XPath-filter condition:
*[System
[EventID=4624]
[TimeCreated[@SystemTime>'2022-02-09T15:38:26']]
]
[EventData
[Data
[@Name='LogonType'] and
(Data=2 or Data=7 or Data=10 or Data=11)
]
[Data
[@Name='WorkstationName'] and
(Data!='-')
]
]
but for any reason the last condition is not filtering anything. I still see event with WorkstationName = '-'. Even if I negate the condition it gives me the exact same events back. How do I need to configure the filter to have 2 conditions based on EventData combined with and AND-logic?
In case you want to test it in the EventLog-Viewer here the full Filter-XML (skipping the time-filter):
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
Event
[System
[EventID=4624]
]
[EventData
[Data
[@Name='LogonType'] and
(Data=2 or Data=7 or Data=10 or Data=11)
]
[Data
[@Name='WorkstationName'] and
(Data!='-')
]
]
</Select>
</Query>
</QueryList>
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
