How WEC - Windows Event collector Subscription Exclude some events for same events but all

[Shonlea]

Hello All,

When creating a subscription for WEC (Windows Event Collector) we can exclude by "Event ID's" But How can we exclude

for some Events for same Event ID but not all Like
Log Name = Security
Event ID = 4624
Task Category = Logon
Logon Type = 1 or 2 or 3 or 4 ....and so on
what we want is
Logon Type = included 1 or 2
Logon Type = Exclude 3 or 4 ....and so on
We like to Include Logon Type 1 and 2 being collected in WEC or Being forwarded to WEC

and Logon Type = Exclude 3 or 4 ....and so on

if this possible can you give me some example how we can do this








Continue reading...