Re: Event Log Forwarder - Where is the Audit Failure Type?

As a temporary workaround, please manually edit the CFG file (LogForwarderSettings.cfg) and change

<keywords>

<string>Audit Success</string>

<string>Audit Failure</string>

</keywords>

To

<keywords>

<string>0x20000000000000</string>

<string>0x10000000000000</string>

</keywords>