# Filter "AND NOT IN" **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [August 24, 2018, 2:00am UTC](https://community.graylog.org/t/filter-and-not-in/6574 "2018-08-24T02:00:12Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ortizleo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ortizleo/32/2382_2.png) [@ortizleo](https://community.graylog.org/u/ortizleo)\ **Post date:** [August 24, 2018, 2:00am UTC](https://community.graylog.org/t/filter-and-not-in/6574/1 "2018-08-24T02:00:12Z")
Hello. How can I find users that as been enabled in Active Directory (EventID 4722) and was not disabled anymore? I mean, no EventID 4725 generated after 4722 until now. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [August 24, 2018, 4:26am UTC](https://community.graylog.org/t/filter-and-not-in/6574/2 "2018-08-24T04:26:49Z")
Did you have the eventID in a single field available? ---
**Author:** ![ortizleo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ortizleo/32/2382_2.png) [@ortizleo](https://community.graylog.org/u/ortizleo)\ **Post date:** [August 24, 2018, 3:47pm UTC](https://community.graylog.org/t/filter-and-not-in/6574/3 "2018-08-24T15:47:36Z")
Yes. Is a normal Windows Log forwarded by NXLog to Graylog. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [September 7, 2018, 3:47pm UTC](https://community.graylog.org/t/filter-and-not-in/6574/4 "2018-09-07T15:47:44Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.