Doing a query on AD events for adding users to groups.  There are 3 events, one for each type of group.  2 of them are very straight forward, account_name is the account, group_name is the group, easy peasy.  However, event 4756 shoves everything into the account_name field, so I get something like this: Account_Name my_username CN=user_I_Added Enterprise Admins   All of this is in 1 line.  Looking inside the event, I get this: Subject: Security ID: mysid Account Name: my_username Account Domain: my domain Logon ID: 0xmyid   Member: Security ID: hersid Account Name: CN=her_username   Group: Security ID: groupside Account Name: Enterprise Admins Account Domain: my_domain   I'd like to select on group_name, but for some reason Enterprise Admins is shoved into one of 3 Account_names in the same event.  Suggestions on parsing this?  "Moving" the name to group_name? ... View more