After configuring an Exclude Accounts template using the AD object picker to select the desired accounts and applying it to exclude SharePoint events does not work as expected. Events from excluded account(s) still produce SharePoint events.
When the AD object picker is used in the Excluded Accounts template wizard the exclusion is locked to the object SID. SharePoint events may not contain a SID field so there is no successful matching during processing by the agent.
In this scenario ensure accounts are excluded from SharePoint event auditing by using the wildcard option in the Excluded Accounts template wizard to exclude the user account(s) in question using domain\username format. This will exclude the events as expected by using the populated username field instead of the SID field.
© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center