fkeough

and help eliminate false positives...

I think option 3 is perhaps the only 1. I have tried changing from WMI, I also unable to filter, because we use and IDS service And they get the logs directly. If SolarWinds has an open case, we could always attach to that as opposed to trying to open Several localized cases. Just my .02

actually the power shell scripts look like something I could use, I see some references for cross forest monitoring. that is the area I think SolarWinds falls short in for MSP. Do these work well in a cross forest arena? Thanks