I have figured this out, the alerting is only availabe to filter on event 4769 which corresponds with 4768. the issue is that 4768 is logged on DC and 4769 on the workstation. Agent was required to be installed on the workstation with event loges forwarding to the LEM to pick this up. both report and filter now work. seems some things you dont need the agent for for everything else you do!
↧