Logon Failures for AdminUsers

Logon Failures for AdminUsers

Hello

We want to use the altert "logon failure for AdminUsers".
Unfortunatly the event ids 4625 which were generated on the DC are excluded in the Global Exclude Configuration.

Is there another way to monitor logon failures on the DC


regards
Marc