Usa evento Winlogon per backup al logoff

This commit is contained in:
2026-07-02 12:48:44 +02:00
parent 976e53a193
commit 641e10afd8

View File

@@ -7,7 +7,7 @@
<Triggers> <Triggers>
<EventTrigger> <EventTrigger>
<Enabled>true</Enabled> <Enabled>true</Enabled>
<Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[(EventID=4647)]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription> <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="System"&gt;&lt;Select Path="System"&gt;*[System[Provider[@Name='Microsoft-Windows-Winlogon'] and EventID=7002]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
</EventTrigger> </EventTrigger>
</Triggers> </Triggers>
<Principals> <Principals>