Hello, has anyone created an alert for an event that indicates that something is attempting to access a disabled Active Directory account?
thank you, Rick
Yep, see this thread:
Alert on login attempts of disabled accounts