# Filter computer object password changes **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [September 20, 2021, 6:21pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651 "2021-09-20T18:21:34Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![WilGG](https://avatars.discourse-cdn.com/v4/letter/w/b487fb/32.png) [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Post date:** [September 20, 2021, 6:21pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/1 "2021-09-20T18:21:34Z")
Good Afternoon Everyone, We are been overwhelmed by computer objects password changes. Does anyone know how to filter this events so we do not skip actual user object password change events ? Thank you! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 21, 2021, 1:13am UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/2 "2021-09-21T01:13:35Z")
Is there a particular event code for those? ---
**Author:** ![WilGG](https://avatars.discourse-cdn.com/v4/letter/w/b487fb/32.png) [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Post date:** [September 21, 2021, 12:24pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/3 "2021-09-21T12:24:37Z")
Event code : 4724 Password changed by admin This event also generates legit user object password changes but includes tones of computer object password change as well. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 21, 2021, 9:32pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/4 "2021-09-21T21:32:19Z")
What does each event look like then, we're after something that distinguishes the two so you can use that to filter them out. ---
**Author:** ![WilGG](https://avatars.discourse-cdn.com/v4/letter/w/b487fb/32.png) [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Post date:** [September 21, 2021, 11:10pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/5 "2021-09-21T23:10:01Z")
1000's of these computer object password changes are due to VDI feature "refresh on logoff" which causes VIEW desktops to change passwords. so the only distinguishing factor is VIEW\_"DESKTOP\_NAME". ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/d/9d3630cebd428379de5237bba64dbc693d7b43af.png) is there a method where we can filter view\_desktop in Kibana or in the forward events. Thank you! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 21, 2021, 11:23pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/6 "2021-09-21T23:23:24Z")
See the little `+` and `-` buttons in your picture? That will show beside other fields and you can exclude (the `-`) that field value from the viz/dashboard. ---
**Author:** ![WilGG](https://avatars.discourse-cdn.com/v4/letter/w/b487fb/32.png) [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Post date:** [October 1, 2021, 2:47pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/7 "2021-10-01T14:47:06Z")
Is there a way to filter computer objects related evnts in the YML file before it gets shipped to Elasticsearch ? Reason: to avoid consumption of space on the ELK stack ---
**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Post date:** [October 1, 2021, 3:23pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/8 "2021-10-01T15:23:33Z")
Hello, Two solutions: 1. Keep the config and the data, and filter in Kibana Search Bar, here is the filter in KQL : `NOT (winlog.event_data.SubjectUserName.keyword : *$)` or `NOT (winlog.event_data.TargetUserName.keyword : *$)` Depending on which Event you need to filter. You are speaking about 4724 and changing password. **But 4724 is for resetting passwords** , not changing passwords (which is 4723) 1. Drop the events you don't need on the winlogbeat agents solution as follow. You can use a drop processor in the winlogbeat.yml config file, here is an example with other events. Modify it for passwords, Change _TargetUserName_ with _SubjectUserName_, according to your needs, depending on the desired event. 4723: An attempt was made to change an account's password 4724: An attempt was made to reset an accounts password ```auto processors: - drop_event.when.or: # Remove Computers from 4625 events - and: - equals.winlog.event_id: 4625 - regexp.winlog.event_data.TargetUserName: '.*\$' # Remove Computers from 4771 events - and: - equals.winlog.event_id: 4771 - regexp.winlog.event_data.TargetUserName: '.*\$' ``` I would suggest the links below to understand the 2 events, you'll find detailed information about SubjectUserName and TargetUserName. [Windows Security Log Event ID 4723 - An attempt was made to change an account's password (ultimatewindowssecurity.com)](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4723) [Windows Security Log Event ID 4724 - An attempt was made to reset an accounts password (ultimatewindowssecurity.com)](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4724) You can check this site for the other security events as well, it's a gold mine ! ---
**Author:** ![WilGG](https://avatars.discourse-cdn.com/v4/letter/w/b487fb/32.png) [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Post date:** [October 15, 2021, 6:37pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/9 "2021-10-15T18:37:13Z")
Thank you so much!!!!!!!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 12, 2021, 8:37pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651/10 "2021-11-12T20:37:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.