查询lyad账号操作AD账号的操作：
Category:"用户帐户管理" AND SubjectUserName:"lyad"
查询对账号zhangsan进行的操作：
Category:"用户帐户管理" AND TargetUserName:"zhangsan"
查询zhangsan登录失败的日志：
EventType:"AUDIT_FAILURE" AND (TargetUserName:"zhangsan" OR ServiceName:"zhangsan")
查询zhangsan登录失败的日志，不查询IP为192.168.1.2/3的日志：
EventType:AUDIT_FAILURE AND (TargetUserName:zhangsan OR ServiceName:zhangsan) -IpAddress:192.168.1.2 -IpAddress:192.168.1.3
查询ly的非移动端登录日志：
cs-username:"ly" -cs-uri-stem:"/Microsoft-Server-ActiveSync/*"