I recently had an interesting customer issue. They wanted to collect some specific events for reporting.  This was specific to NTLM authentications.  The problem was … Continue reading How to collect events – but not ALL the events?