New answers tagged


While Windows allows filtering, you cannot divert certain events based on ID to a different log. It is to some extent possible to divert certain event sources to their own event log (e.g. you can create a specific log for a software product and redirect its events to that log), but the security log is pretty much immutable. If this is really bothersome to ...


Note that in Win2008 server and above, you need to use the "Advanced Audit Policy Configuration" options in the GPO. See screenshot:


Pretty sure your problem is: Data=’0x84e9c0d′ Those quote characters are mismatched and neither of those characters appear to be the single quote character (') that is expected.

Top 50 recent answers are included