Filter Event Viewer Security Log by Account Name

1. Click “Filter Current Log” on Actions menu.

   

2. Click “XML” tab
3. Select “Edit Query manually“

   

4. Paste one of below query and replace “User/Description” with relevant User Name/Description.
   
   <QueryList>
   <Query Id=”0″ Path=”Security”>
   <Select Path=”Security”>* [EventData[Data[@Name=’subjectUsername’]=’AccountName‘]]</Select>
   </Query>
   </QueryList>

   ………………………………………………………………………………….
   
   <QueryList>
   <Query Id=”0″>
   <Select Path=”Security”>
   *[EventData[Data[@Name=’SubjectUserName’] and (Data=’description‘)]]
   </Select>
   </Query>
   </QueryList>

   

5. Click OK

6. To clear the filter click “Clear Filter“
   

More customized Queries..
http://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx