Windows Logs>Application

[MikW]

Hi,

I have problems seeing EventID 12294 from Security-SPP.
It's for KMS publishing itself to DNS.

It is not from unsupported Applications and Services logs, it's not even there.
It is located in Windows logs > Application.

Log Name: Application
Source:Security-SPP
Event ID: 12294
Level: Information

Is it possible to filter that out in a report?

Select Distinct Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.IPAddress,
  tblNtlogSource.Sourcename,
  Max(tblNtlog.TimeGenerated) As LastOccurrence,
  tblADusers.Displayname,
  tblAssets.OScode,
  tblNtlogMessage.Message,
  tblNtlog.Eventcode
From tblAssets
  Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
    tblNtlog.SourcenameID
  Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
  Left Join tblADusers On tblADusers.Username = tblAssets.Username And
    tblADusers.Userdomain = tblAssets.Userdomain
Group By tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.IPAddress,
  tblNtlogSource.Sourcename,
  tblADusers.Displayname,
  tblAssets.OScode,
  tblNtlogMessage.Message,
  tblNtlog.Eventcode
Having tblNtlog.Eventcode In (12294)
Order By LastOccurrence Desc

[Esben_D]

The report itself looks fine. Have you enabled non-error event scanning within Lansweeper? Instructions can be found here: https://www.lansweeper.com/kb/128/scanning-non-error-events.html