- Access the Windows "Event Viewer"
- Right click on "Security" section and select 'Create Custom View...'
- Click on the XML tab
- Check the 'Edit XML' radio button
- Then enter a quitable query such as
<QueryList>
<Query Id="0">
<Select Path="Security">
*[EventData[Data[@Name='SubjectUserName'] and (Data='JBloggs' or Data='JoeBloggs')]]
</Select>
</Query>
</QueryList>