To search for events related to 'Audit Login Failed' using the WHO tab:
Use the LIKE option specified as 'Domain\UserName' format. This will not lock the search to the AD 'UserSID' field but instead look to the 'UserName' field.
To purge events related to 'Audit Login Failed' using the WHO tab:
Use the LIKE option specified as 'Domain\UserName'. This will not lock the search to the AD 'UserSID' field but instead look to the 'UserName' field.