Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

How to Create a Monitor to Alert on a Locked AD Account (Windows Server 2008 R2)

Ok, so I have been working with APM for a few weeks, and in the last few days have been trying to replicate this function in APM (I had it in SCOM and it worked great).

I know that in windows 2K8 R2, the EventID to look for is 4740, and I know that there is a shared template for checking for Event IDs that can find this EventID, but the problem comes when I tried to use logic to search through the EventDescription field to find a specific username, and then send out an alert via email if the account gets locked.

This works excellent for service accounts that are critical to the functions of applications. If the account is locked, a number of things begin to fail.

Here is the logic that I used in SCOM, but I don't know how to store the data in the Component, so that the alert can grab it via variables to send out the alert for the specific criteria.

And Group ALL of these are true
    EventID is equal to 4740
    Or Group ANY of these are true
        EventDescription is equal to username1
        EventDescription is equal to username2
        EventDescription is equal to username3

I know that I won't be able to do this all inside of the Application component or the Alert by itself, but I'm hoping that there is a way to use them together to make it work.

Thanks in advance for any help you can offer.

Find more posts tagged with

Accepted answers

All comments

aLTeReGo

Have you looked at either of the following application templates that report on the number of locked out user accounts?

http://www.solarwinds.com/NetPerfMon/SolarWinds/ApplicationPerformanceMonitorAdministratorGuide.06.651.htm

http://www.solarwinds.com/NetPerfMon/SolarWinds/ApplicationPerformanceMonitorAdministratorGuide.06.652.htm

vdubn

Yea, I saw those, and they can get me lists of data, like all disabled users, all locked out users, etc.

I need to get the name of the user that was locked out, check if its one of our admin/system accounts, and then notify people based on which user it is.

I did some work late last week, with an Orion tech, and it looks like the way to do it is to use the Solarwinds Log Forwarder on the DC that I need to monitor, then using the SysLog Viewer on the Orion server, I can parse data and find which user, then create an alert based on that criteria. As I get all of the details sorted out, I will post back how it worked. I didn't really want to install any software onto my DC's, but the Log Forwarder has a small footprint, so should be ok.

FormerMember

How did this process work out for you?