Event Monitor alert to include current user

dgeiger

I am working on an alert to send to our help desk when users have a specific application crash on a Windows workstation. I have created the event monitor to alert on the crash and that is working as expected. The part I am having trouble with is returning the current active user. I have asset inventory enabled on these nodes but that only polls once a day so using the "lastloggedinuser" is not accurate.  Is there a more accurate way to pull the current logged in user when I receive this crash event?  I am not great with the Powershell monitor and have tried that route but even if I do get the statistic returned I am unsure how to add that variable to the alert email.  Any help would be greatly appreciated. 

Thank you,

npatterson

I think this is will more a manual task as you will have to look for the last login enter from before the crash. Which event type are you using to pull data for the alert. 

For example, the Host Incident event has different information Userlogonfailure event so you could link correlate data from the new different event for more information.  

So back to your question look for other similar events that also get trigger at the same time so you can cross reference and get more information. 

It is very dependent on what event you are using to activate your alert.