Filter "AND NOT IN"


(Leonardo Ortiz) #1

Hello.
How can I find users that as been enabled in Active Directory (EventID 4722) and was not disabled anymore? I mean, no EventID 4725 generated after 4722 until now.


(Jan Doberstein) #2

Did you have the eventID in a single field available?


(Leonardo Ortiz) #3

Yes. Is a normal Windows Log forwarded by NXLog to Graylog.


(system) #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.