Posted April 5, 201312 yr I want to be able to monitor events 4725 in the security event log. The event notifies me when a user account is disabled. The problem is I have one account which auto disables itself and I continue to get notifications about that account. I would like to be able to exclude certain keywords from the event filter so that any event that has a specific keyword is excluded. Ex: All events with ID 4725 Except events with the following keyword: sbsmgracct Possible?
April 5, 201312 yr Administrators Hello, I don't think this is supported for the moment. Also rather than monitoring event log for disabled accounts you can use Active Directory Disabled Accounts notification. +1 for this
Create an account or sign in to comment