marinhd Posted April 5, 2013 Share Posted April 5, 2013 I want to be able to monitor events 4725 in the security event log. The event notifies me when a user account is disabled. The problem is I have one account which auto disables itself and I continue to get notifications about that account. I would like to be able to exclude certain keywords from the event filter so that any event that has a specific keyword is excluded. Ex: All events with ID 4725 Except events with the following keyword: sbsmgracct Possible? Link to comment Share on other sites More sharing options...
Administrators Paul Posted April 5, 2013 Administrators Share Posted April 5, 2013 Hello, I don't think this is supported for the moment. Also rather than monitoring event log for disabled accounts you can use Active Directory Disabled Accounts notification. +1 for this Link to comment Share on other sites More sharing options...
Administrators Marius Posted April 5, 2013 Administrators Share Posted April 5, 2013 Excluding keywords it's a good idea, it will be added in the next release. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now