Return
-
Title
How to exclude events from a search/report -
Description
Running an All Active Directory search/report and getting events that are not required for the report. How can certain events such as 'User account locked' and 'User account unlocked' be excluded? -
Cause
By default all Active Directory events are included in the default All Active Directory Events search, so undesirable events must be excluded from the results. -
Resolution
To exclude events from a search/report:
- Select the search the report is based on.
- In the Search Properties select the What tab.
- Highlight the Entity and select the Add button on the menu bar above.
- In the Add Facilities or Event Classes window locate the event class or classes you wish to exclude.
- Add the Event class or classes to the search by selecting the Add button in the lower left hand quadrant.
- Place a check mark in the 'Exclude The Above Selection(s) option in the lower left hand corrner.
- Click OK and the exclusion is added to the search.
- Save the changes to the search.