Point 4 might seem an odd request but in my environment, we have some software that is setup to try and authenticate certain accounts against AD first then another LDAP provider. If the account fails against AD, it moves onto the next LDAP provider configured etc. This generate a lot of 'Unknown account' events naturally on the DCs and these are collected in ADAuditPLus. Would be nice to be able to exclude them for arbitrary users :)