I have a role assigned to an AD group that limits their access to specific events in a windows event log index.
The restriction on the role reads "EventCode=4740 OR EventCode=4625 OR " etc...
This same group wants access to another index. However the restriction on the role above prevents them from reading events from the other index because none of those events exist in the other index.
How to resolve this issue?
↧