mosigra wiki

Журналы приложений и служб → Microsoft → Windows → TerminalServices-LocalSessionManager → Operational

<QueryList>
<Query Id="0" Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">
<Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[System[(EventID=22 or EventID=23)]] and *[UserData[EventXML[(User='MI\Киселев Сергей')]]]</Select>
</Query>
</QueryList>

Журналы Windows → Безопасность

<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=4624 or EventID=4625)]] and *[EventData[Data[@Name='LogonType'] and Data=10]] and *[EventData[Data[@Name='TargetUserName'] and Data='Киселев Сергей']]</Select>
</Query>
</QueryList>

• [System[(EventID=4624 or EventID=4625)]] - коды событий
• [System[Provider[@Name='Microsoft-Windows-Security-Auditing']]] - источник
• [System[TimeCreated[@SystemTime>='2016-11-14T10:00:00.000Z' and @SystemTime<='2016-11-14T11:00:00.999Z']]] - время события
• [System[(Level=4 or Level=0)]] - уровень события