Is there a way to exclude "hotfix" events for 'All Domain Controller Events' without excluding other changes?
There may be many events associated with patching which are not critical to see in the report.
1) On the search select the "What" tab.
2) Click Add | Subsystem | Registry...
3) Select "This Object and All Child Objects".
4) Copy\paste to the following "Path" field or navigate to 'HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Component Based Servicing\Packages\' and click 'Add'.
5) Copy\paste to the following "Path" field or navigate to 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\' and click 'Add'.
6) Enable "Exclude the above selection" box in the bottom left.
7) Click "OK".
8) Save the search.
Now changes below 'HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Component Based Servicing\Packages\' and 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\' should be excluded from the search results.
© 2025 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center