# Help with Winlogbeat and filtering computer accounts

**URL:** <https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792>\
**Category:** Elasticsearch\
**Created:** [December 2, 2021, 3:57pm UTC](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792 "2021-12-02T15:57:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joachim\_johannesen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joachim_johannesen/32/98029_2.png) [@joachim\_johannesen](https://discuss.elastic.co/u/joachim_johannesen)\
**Post date:** [December 2, 2021, 3:57pm UTC](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792/1 "2021-12-02T15:57:48Z")

</div>

I have a few ELK stacks up and running but I'm getting a lot of false 'Admin User Sessions' which are the computer accounts eg computer$. I'm using Windows Event forwarding to send all security related events over to my winlogbeat system then ship them over to ELK.

I tried to drop some of the events but how do I drop these computer objects from showing up as normal users?

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76e7a99ae5a808c63283701d04f2224a919a0f0e.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88e1171ebd1d9783c72fbc21377aa189329442b1.png)

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2021, 3:58pm UTC](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792/2 "2021-12-30T15:58:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.