LEM: Create notification of AD account lockout

aca5tle

How can I setup a notification alert when a user is locked out of Active Directory?

I am using SolarWinds Log & Event Manager 5.4

Thanks

phil3

Hi, aca5tle.

We have a NATO5 rule called "User Account Lockout (Updated)" that you can configure to send you an email anytime a user locks himself out. You can also use the same logic to create a filter or nDepth search:

UserDisable.EventInfo = *Account Lock*

If you're not too familiar with LEM, here are some additional details:

• To enable a NATO5 rule, go to Build > Rules, click the NATO5 Rules folder, and then search for the rule using the search box. Clone is a gear-menu option, and it automatically opens the rule editor so you can select the recipients for the email.
• In the logic noted above, "UserDisable" is the alert, "EventInfo" is the field, and "Account Lock" is the search value with asterisks as wildcard characters.
• If you build a filter using that logic, you can send it to nDepth at any time to search for historical instances of that alert-value pair.

For additional information about these steps, see:

• SolarWinds Knowledge Base :: Cloning, Enabling, and Activating NATO5 Rules
• SolarWinds Knowledge Base :: Creating Filters for Real-time Monitoring in Your LEM Console
• SolarWinds Knowledge Base :: Sending Filters to nDepth for Historical Search

I hope this helps.

Phil