In the year 2018 Microsoft Event Viewer is unable to filter events by username.
Seriously, what the fuck?
- Enable file auditing for a folder to find out who is deleting stuff.
- Go to Event Viewer>Security -- oh there are a bunch of Detailed File Share events now, that is exactly what i want. Open one, see a username, the file they opened/changed/deleted, good.
- Action Pane > Filter Current Log > Username field, type in username of a user that is listed in one of the Detailed File Share events. 0 results returned. Check with a different, valid username. 0 results returned.
- Rage and Rant here.