Feature Request: Easy XML Filtering about eventlogexpert HOT 5 CLOSED

What event source and event ID is this example?

from eventlogexpert.

It looks like git stripped out what I wrote. Here's a screenshot of what was supposed to be there:

I don't know if that uploaded an image or not.

Microsoft-Windows-Security-Auditing EventID 4769

from eventlogexpert.

With the release that went live a couple of hours ago, you can click Add Advanced Filter. In the textbox type:

Xml.Contains("\"TicketEncryptionType\">0x17<")

I think that will find these events.

Edit: Deleted my first edit, because I was able to test this and it does work in my lab. Escaping the quotes this way seems to work.

from eventlogexpert.

Well, I know there's an event that matches, but its not resolving. And when I click on it manually, "An unhandled exception has occurred" I don't really get anything other than that to give you though.

from eventlogexpert.

Hmm, I do see these on a DC in my lab:

And I am able to filter by the TicketEncryptionType. All mine are -1, so if I filter for that:

But if I change it to something else, like -2:

So it seems to be working.

from eventlogexpert.