4625 Events disappeared from the Security log before our eyes

%3CLINGO-SUB%20id%3D%22lingo-sub-2355663%22%20slang%3D%22en-US%22%3E4625%20Events%20disappeared%20from%20the%20Security%20log%20before%20our%20eyes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2355663%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3EAll%20events%20of%20type%204625%20disappeared%20a%20few%20minutes%20after%20I%20created%20the%20new%20filter%20looking%20for%20%3CBR%20%2F%3Ethose%20specifically.%20%20%3C%2FPRE%3E%3CPRE%3EThey%20transitioned%20to%20%22deleted%20event%22%20while%20I%20was%20looking%20at%20them%2C%20before%20my%20eyes%3C%2FPRE%3E%3CP%3EHas%20anyone%20ever%20seen%20that%20happen%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2355663%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Visitor

 

All events of type 4625 disappeared a few minutes after I created the new filter looking for 
those specifically.
They transitioned to "deleted event" while I was looking at them, before my eyes

Has anyone ever seen that happen?

0 Replies