((EventID:4720 SamAccountName:$*) OR (EventID:4781 NewTargetUserName:$*)) (-(EventID:4720 TargetUserName:HomeGroupUser$))