2 replies to this topic

[abteenz]

I want to log the login attempts on file servers but it logs all the file access logon events categorized as Logon Type: 3.

I want only alert on logon type: 2

 

how this is achieved? 

 

thanks

[jeffb]

abteenz,

 

You can create an exclusion filter for the network logon type.  The index would be 9 and the substring would be 3.

 

-Jeff

[abteenz]

You mean something like this?