I have a similar issue, in the Message field from a specific event code from the WinEventLogs it says
"A memeber was added to a security-enabled global group."
Subject:
Security ID:
I want everything after the period "group." gone. I tried the above rex however nothing changed.
... View more