Ming Chou 0 Posted December 14, 2023 Share Posted December 14, 2023 Hi, We have enforced a policy to block all USB data storage, except ones we allow by name and model. Now i want a report that shows who tried to use an USB besides our approved USB. see photo what i've created. Now i want to either filter on "user" that contains, but when i add the filter and set it on "contains" i am only able to use one. Is it possible to use multiple ? Option 2 would be to filter out the "NT Authority" but i cannot seem to find the correct filter for this. Link to comment Share on other sites More sharing options...
Administrators Solution Marcos 5,074 Posted December 14, 2023 Administrators Solution Share Posted December 14, 2023 What about using "not equal" or "is not one of" for the user "NT Authority\System"? Link to comment Share on other sites More sharing options...
Ming Chou 0 Posted December 18, 2023 Author Share Posted December 18, 2023 Hi Marcos, It works, thank you so much. Link to comment Share on other sites More sharing options...
Recommended Posts