hi dm, i didn't know you could use Where Logfile='Security' Where EventCode='672'
"Select * from Win32_NTLogEvent Where Logfile = 'Security' And EventCode='672' And User Like '_gmagerr%'"
i thought you could only have one Where condition, and have to use the Ands. that's really neat!