Can't audit event 4625

Can't audit event 4625

Event 4625 can alert when VPN users logon failed (my firewall connected to my DC with LDAP).
I found that this event is excluded by Global Exclude rule and I can't remove or edit it.
Is there any way to remove a default Global Exclude rule?
        New to M365 Manager Plus?
        New to M365 Manager Plus?
          New to RecoveryManager Plus?
          New to RecoveryManager Plus?
            New to Exchange Reporter Plus?
            New to Exchange Reporter Plus?
              New to SharePoint Manager Plus?
              New to SharePoint Manager Plus?
                See all integrations
                New to ADManager Plus?

                  New to ADSelfService Plus?

                  Start your free trial





                            Related Products