---
tags:
- "\U0001F6A9purpose/\U0001F5FA️guide"
- "⭐topic/\U0001F4BEsoftware/windows/server"
---
# XML filter for username in Event Viewer   
   
When querying for event 4625 (user lockout) or other similar events on DCs, you can filter by username using the below XML query in addition to whatever else might be necessary.   
```xml
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">* [EventData[Data[@Name='TargetUserName']='myuser']]</Select>
  </Query>
</QueryList>
```