Hello GL friends!!
So here’s a hopefully simple query question.
I have a windows event, 4624 to be specific tracking successful windows logons. In my search I am trying to exclude the computer accounts that show up as $ names so that all I get are the actual users that logged in.
Here’s the search I’m using:
EventID:4624 AND LogonType:3 AND NOT (WorkstationName:-) AND NOT (TargetUserName:HealthMailbox* OR TargetUserName:“ANONYMOUS LOGON”)
And I get these accounts as a sample result:
I’m trying to exclude the accounts with a $ at the end. How can I do that in my search?