Filter "AND NOT IN"

How can I find users that as been enabled in Active Directory (EventID 4722) and was not disabled anymore? I mean, no EventID 4725 generated after 4722 until now.

Did you have the eventID in a single field available?

Yes. Is a normal Windows Log forwarded by NXLog to Graylog.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.