BBWin Messages | Filter Security 🔗 link

Hi

For the life of me i cant figure out how to block certain 529 windows
security failure errors for specific users. In the documentation it states
to use the "USER" attribute but this only works if the user is mentioned in
the user field of the error log. If it mentions "NT AUTHORITY\SYSTEM", is
it not possible to restrict it based on the user?

Example:

security: failure - 2009/04/13 17:40:55 - Security (529) - NT
AUTHORITY\SYSTEM
 "Logon Failure: Reason: Unknown user name or bad password User Name:
John1234
 Domain: CONTOSO Logon Type: 3 Logon Process: NtLmSsp Authentication
Package:
 NTLM Workstation Name: \\123.45.67.89 Caller User Name: - Caller Domain: -
Caller
 Logon ID: - Caller Process ID: - Transited

The username is "NT AUTHORITY\SYSTEM" but the actualy user is "John1234"..

Anybody have and ideas? I dont want to block "NT AUTHORITY\SYSTEM".

RESOLVED:

For all interested:

Use the attribute VALUE="" instead of USER=""

VALUE="John1234" will result in the ignore working...it searches the event
details for any match in the VALUE