How to search the Windows Event Log for logins by usernamePosted on 10 September 2012 by Beaming Support
In order to search the Windows Event Log for logins by username you will need to be using Windows Server 2008
The following steps will allow you to search the Windows Event log for logins by username.
- Open event viewer and select the Security Logs
- Select filter current log in the Actions pane.
- Select XML tab
- Select ‘Edit query manually’
- Replace the line <Select Path=”Security”>*</Select> with the highlighted line below and select okay.
<QueryList> <Query Id=”0″ Path=”Security”> <Select Path=”Security”>* [EventData[Data[@Name=’TargetUserName’]=’USERNAME’]]</Select> </Query> </QueryList>
6. Change the USERNAME field to the appropriate username configured in active directory for the user you are searching security events for.
7. The results now show your custom security log XML search.
8. Do not forget to revert the change after running your searches
Avoid internet downtime
IT professionals in UK businesses dealt with 60M hours of internet outages last year.