I'm looking to create a filter for Remote Assistance sessions. Has anyone figured out a way to do this that captures the account information of the connecting "expert"? I see events for the logon and events that show the process start, but don't see a good way to capture both of these correlating events in the same filter or a single event that captures both pieces of info.
↧