topic blacklist an event id 4670 with task category: Authorization Policy Change in Getting Data In

blacklist an event id 4670 with task category: Authorization Policy Change

nathanpyun — Fri, 23 Oct 2015 13:07:38 GMT

Hi, I am trying to blacklist an event id 4670 with task category: Authorization Policy Change

I've tried:

blacklist 1 = EventCode="4670" Task_Category="Authorization Policy Change"

blacklist 1 = EventCode="4670" TaskCategory="Authorization Policy Change"

blacklist 1 = EventCode="4670" Task_Category="s+Authorization Policy Change"

but none works....can someone please tell me what I am doing wrong?

Thank you in advance.

Re: blacklist an event id 4670 with task category: Authorization Policy Change

Richfez — Fri, 23 Oct 2015 23:38:30 GMT

Please check blacklist1 has no space in it.

Re: blacklist an event id 4670 with task category: Authorization Policy Change

Richfez — Sat, 24 Oct 2015 02:32:57 GMT

According to the docs (and from experience), it'll be "TaskCategory". If the TaskCategory is exactly "Authorization Policy Change" (which google says is likely, then number 2 should have worked. Of course, there's the space issue, which may be real or may just be the editor. I'm going to assume it's a copy and paste and thus the space is a problem. So, your blacklist should be

blacklist1 = EventCode="4670" TaskCategory="Authorization Policy Change"

I don't have any of those events in my logs, so if it doesn't work, please confirm that's exactly the right TaskCategory String.