Correct NTLM v1 search to exclude v1 in other areas of the event