As a means of avoiding the monitoring of non-applicable network events, the Event Monitor excludes the monitoring of the following Active Directory containers:
Builtin
Foreign Security Principals
Managed Service Accounts
Program Data
System