I am trying to use XML to filter the security event log to show all user logon events, except I don't want to see "SYSTEM" which is the majority of entries. I don't know why there is a log of the system logging onto itself. That's obviously not
what I'm looking for. Here's what I'm trying:
<Query Id="0" Path="Security">
*[EventData[Data[@Name='TargetUserName'] and (Data !='SYSTEM')]]
But this continues to give results that include <EventData> entries like
Data !='SYSTEM' was supposed to filter that out, but it's not. Is there some reason that it accepts this, but does not consider != to mean not equals???? Any clues? Is there another way to say not equals?
Microsoft is conducting an online survey to understand your opinion of the Technet Web site. If you choose to participate, the online survey will be presented to you when you leave the Technet Web site.