I would like a way to stop NT Authority\System coming in from FIM. I open a file and 9 out of 13 events is from NT\System
Not just filters. I would like the events to not even hit the LEM. The less events it has to store the better. IMHO the fact that NY\system did anything to a file doesn't help in auditing.
Need to know who did what.
A second thought - the .tmp and ~$ files are also a bit much. I have tried filtering it without success and also tried this article without success https://thwack.solarwinds.com/thread/71965
