Event ID 4769 NULL SID Audit Failure

S

SteveBinReno

Yeah, I know: "You can safely ignore these messages".

1. A failure event occurred or this message likely wouldn't be here. But let's ignore that for now.

2. How do I disable THESE SPECIFIC messages *without* disabling all logon auditing? I do NOT want to disable legit logon failure events for obvious reasons. I've already tried creating a custom filter with "-4769" as an exclusion filter but it masks off all entries.

Thoughts? Thanks!

SteveInReno

Continue reading...
 
Back
Top Bottom