How to track new/changed Admin account

How does one use LEM to report and alert when there is a creation or edit to a domain admin account?

Find more posts tagged with

siem

admin

lem

user_accounts

Accepted answers

Look under build - > Rules. There should be a rule:

Configured Critical Group Events.

However if you don't have it:

The users in the group can be found under Build -> Gropus -Name: Admin Groups. I added my VPN and exchange groups to the list:

All comments

Look under build - > Rules. There should be a rule:

Configured Critical Group Events.

However if you don't have it:

The users in the group can be found under Build -> Gropus -Name: Admin Groups. I added my VPN and exchange groups to the list:

I've tried the above. I have gone to my Active Directory server and added Domain Admin to my account and then removed it and I don't get the alert (email). I have another rule that emails me when a user logs on and it does work, so I think I've set up the email template OK. Is there anything that people commonly do to cause this rule to not work?

Thanks...........Rick

Quick Links