JacSad · ***** · ✭

event are in DC's. We used Windows event forwarding and collector but there is a lot of noise collected and reading data is not easy. We're looking a way to use solarwinds to get this info from DC's.

@bobmarley thanks for help, it works.

Can we implement collecting these logs and retrieve reports with Observability Self-Hosted Advanced Enterprise Licence ?

Thanks for your answer. I figured out that I can use tags with user's login/logout/failed and event ID, but we have few Domain Controllers. Users are not logged into only one. Does it mean we need to install agents to every DC that can authenticate user ?