Why are users being seen as services accounts at logon?

[Heritic88]

I am using a virtual server and all users are being seen as service accounts.  Which is causing my logon and admin account searches to show some very high numbers (authentications are showing as logons).  Is there a way to get the system to ignore the actual service accounts that are running that are not users where as both are being seen as a logon type 3 (Network)?

[richgalloway]

Are you filtering out logons where the account name ends with "$"?

[Heritic88]

Index=wineventlog Eventcode= 4624 user!=*$ user!=system | stats count 

updated