I have what appears to be a simple filter, but it is not working. I would like to view all events from a particular server, except for login failures and successes.
I started simple to just show logs from the server except with event ID 4771. When I run the web query, it includes events 4771 for that particular server
I have tried with and without quotes.
I would eventually like to also filter out event IDs 4768 and 4624.
Thanks
Dave