Community Archive (Customer) asked a question.
Custom Windows Event Logon monitor for specific user ID
I'm struggling with the setup of a Windows Logon monitor. I've created the monitor, assigned an emailing alert for when it is down and upon testing received close to 50 alerts, none of which have the information populating that I'm looking for. Here is what I'm looking at:
@Jack Falvey What shows in the logs under Analyze > Logs > Windows Event Log? I am wondering if you've applied a proper action for this type of monitoring (noting that, you would want to use the %PassiveMonitor variables in your action as opposed to %Device variables)
I was originally getting several alerts, all at once, for the Logon Event Monitor being down without any additional information. I did try the monitor with a username, and a fqdn, and a domain/username, but nothing seemed to alert properly. I can see the event on the server itself when I log in.
Ok, so you will need to add the username to the Match On portion of the monitor. Have you tried that? Or is the issue that you are getting notified for events that aren't 4674?
I've been working on other things so this isn't as fresh as it was last week, but here's what I can show you:
Other than that, I have an action tied to it for email alerts. I basically want it to alert me whenever a specific user logs in or off of a subset of boxes.
Can you post a screenshot of the monitor applied to the device?