I am trying to search event logs for an event when a user password is set to not expire. But the alert I have setup flags for all account changes not just the one where the Don't expire password - enabled. Any assistance is appreciated. Here is the search string I have. source="WinEventLog:security" EventCode=4738 user=* | eval Modifier=mvindex(Security_ID,0) | eval AccountChanged=mvindex(Security_ID,1) | eval ActionTaken=case(EventCode="4738","User Account Control") | eval ActionHelper=case(EventCode="4738","Don't Expire Password - enabled") | table _time, Modifier, ActionTaken, AccountChanged, ActionHelper ... View more