Quantcast
Channel: THWACK: Message List
Viewing all articles
Browse latest Browse all 20693

Re: Alerting on 4740 Event IDs (lockouts) for subset of users

$
0
0

The Windows Event Log Monitor "Keywords" should allow for partial matching. Have you tried using just "sv" in that field and seeing if that limits the results to only the service accounts you're looking for? Another option would be to customize the "Locked out users" script to look for only service accounts that are locked out. I'm sure someone in the Script Lab would be able to assist you with that if you need assistance.

    

 

EventLogMonitor.png

 

Another option depending how many service accounts you have would be to duplicate this component monitor for each service account, placing the full service account name within the keywords field.


Viewing all articles
Browse latest Browse all 20693

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>