diff --git a/config/filter.d/xrdp.conf b/config/filter.d/xrdp.conf
index 803219f6..253bcf8d 100644
--- a/config/filter.d/xrdp.conf
+++ b/config/filter.d/xrdp.conf
@@ -25,7 +25,7 @@ _daemon = xrdp-sesman
 
 [Definition]
 
-authfail_re = \[INFO \] AUTHFAIL: user=<F-USER>.+</F-USER> ip=<ADDR> time=\d+
+authfail_re = \[INFO \] AUTHFAIL: user=<F-USER>(?:\S+|.+)</F-USER> ip=<ADDR> time=\d+
 
 failregex = ^%(__prefix_line)s%(authfail_re)s$