Windows XML Security Filtering

Use the following filter to view logons for a particular user.

<QueryList>
 <Query Id="0" Path="Security">
 <Select Path="Security">*[System[(EventID='4624')]
and
EventData[Data[@Name='TargetUserName']='username'] ]
</Select>
 </Query>
</QueryList>