I want to filter the Subject Account Name in the Event log below as those other than Admin. So I want to see the cases where this log appears outside of the Admin. How can I do it ?
11/29/2022 12:23:16 PM
LogName=Security
EventCode=4738
EventType=0
ComputerName=dc.windomain.local
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=247213
Keywords=Audit Success
TaskCategory=User Account Management
OpCode=Info
Message=A user account was changed.
Subject:
Security ID: S-1-5-21-4236582264-665789389-1555517817-1000
Account Name: Admin
Account Domain: WINDOMAIN
Logon ID: 0x59B44
Target Account:
Security ID: S-1-5-21-4236582264-665789389-1555517817-1324
Account Name: aleda.billye
Account Domain: WINDOMAIN
... View more
