What goes into the "Data" field when defining the "Approved DNS Servers?"

Hello again, Steve.

Use the machine name of your servers, surrounded by asterisks. The asterisks serve as wildcard characters so you don't have to enter the FQDN.

If you find that the alerts needed for your rules/filters/etc. reflect IP addresses instead of machine names, you might consider cloning the group and having one with machine names and one with IP addresses. This shouldn't be necessary, however, because the vast majority (maybe all) of the Windows messages you'll be using with this group log machine names, not IP addresses.

Let me know if you run into any snags.

Thanks.

For additional information about what groups need to be customized and how to customize them, check out this new KB: Getting Started with User-Defined Groups.

Thanks for the tip! :)