Usa evento Winlogon per backup al logoff
This commit is contained in:
@@ -7,7 +7,7 @@
|
||||
<Triggers>
|
||||
<EventTrigger>
|
||||
<Enabled>true</Enabled>
|
||||
<Subscription><QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[(EventID=4647)]]</Select></Query></QueryList></Subscription>
|
||||
<Subscription><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Winlogon'] and EventID=7002]]</Select></Query></QueryList></Subscription>
|
||||
</EventTrigger>
|
||||
</Triggers>
|
||||
<Principals>
|
||||
|
||||
Reference in New Issue
Block a user