event log monitor - custom log
i'm trying to monitor event id 25, under Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
i'm not sure i'm doing this right because it's not working
i've made a custom rule, and under file i tried both full path and event viewer file only
i've then made a new log that is like this (see attached picture)
New to ADSelfService Plus?