With 1.2 Guided labs I have 2 issues.
- XML code in the instructions is listed:
*
[
EventData[Data[@Name=‘LogonType’]=‘10’]
]
However when I enter this code, there is a system message “invalid”
When I type in the revised xml code below, there is no error message. Is this the correct code?
*[System[EventID=4624]] and *[EventData[Data[@Name='LogonType']='10']] and *[EventData[Data[@Name='TargetUserName']='Administrator']]
- Where is the Administrator RDP login event in the Event Viewer (Screenshot attached)
I could not find the account information.
Thank you!
Hey there - could you please share a screenshot of the edited XML in your lab? I’ve run through these steps and verified that the instructions are correct. Editing the XML as shown in the lab and in the screenshot below will result in a single record being surfaced in the Event Viewer.
1 Like
Hello,
Here is a screenshot of what I revised per the lab instructions. However, there is no “OK” button. Why is there no “OK” button? I tried refreshing the lab several times, and closing out of the Filter Current Log and re-entering the revised XML code, but there is still no “OK button”. This is a new issue.
Hey there - the issue is that your browser viewport is too small and and bottom of the window is getting cut off. I would recommend entering full screen mode in your browser.
1 Like
