(imported topic written by dgaynor91)
Hello. I’ve been running an analysis to report logged in domain users for the < 45 days (also < 90 days) for about a year. The analysis was working great but now I’m getting for results for several domains. Other domains are reporting as expected. I checked the event log on a non-reporting device but found no errors or anything unusual for event id 528. Any ideas?
(multiplicity of it, it) of (unique values of (user sid of it as string) of records whose ((now - time generated of it < 45*day) AND (event id of it as string = “528”) AND ((";2;7;10;11;") contains “;” & preceding text of first “%0d” of following text of first “Logon Type:%09” of descriptions of it as string & “;”)) of security event log)
Dix