DCs(must be FQDN of the DCs)

[darioongit]

Hi,

are you sure about this statement?
[...]
DCs(must be FQDN of the DCs)
[...]

in the EventID 4768 i saw all the time the NetBiosName with the $

when you compare computer list with the DCs, it works because the format is FQDN with FQDN
| where Computer in~ (DCs)

but when you do the DCs (FQDN ) compare with TargetUserName(NetBiosName) it shouldn't work
| where DCs has replace_string(TargetUserName,"$","")

also, because i think it is impossible to have the $ in TargetUserName with the FDQN format:

yourdc1.yourdomain.local$
yourdc1$.yourdomain.local

[darioongit]

Nevermind, i see that you are using the DCs has for have partial match