Global Exclude Configuration

Global Exclude Configuration in ADAudit Plus lets you minimize event noise by excluding certain high volume system events that can be considered nonessential. The Global Exclude Configuration page contains a set of predefined rules for specific event categories, with the option to add and modify custom rules according to your requirements.

To add custom rules, click on Add Exclude Rule. Listed below are commonly excluded events along with the variable name to be excluded. For example, to exclude logon event ID 4776 triggered by a particular user, use the Logon Account variable name.

Event ID	Variable name
Logon To exclude logon events by a particular user:
4776	Logon Account
4768	Account Name
4771	Account Name
Directory service To exclude directory service events by a particular user:
5136	Account Name
5137	Account Name
5141	Account Name
4662	Account Name
To exclude directory service events on a particular attribute
5136	LDAP display Name
Process tracking To exclude process events by a particular user
4688	Account Name
4689	Account Name
Account management To exclude account management events by a particular user (caller user name):
4720	Subject Account Name
4738	Subject Account Name
To exclude account management events on a particular user (target user):
4720	Account Name
4738	Account Name