I appreciate the assistance but unfortunately that's not working. When applied, it looks like it's blocking only Access Mask 0x100 which is what the LAPS events fall under. I had been considering compromising and allowing all 0x100 though, and I tried that a few different ways, but it seems like no matter what I try if I do ANY blacklisting of EventCode 4662 of any kind, the LAPS logs won't show up. When allowing 0x100, other 0x100 logs show up but the LAPS ones do not for some reason. When I remove any 4662 blacklists, they start showing up again. ... View more

Were you ever able to figure this out? I'm having the exact same issue trying to filter 4662 while allowing the group policy AND LAPS logs. ... View more