cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 9

ComponentAlert.WindowsEventMessages

Is there anyway to get this to email more then the first 10 or so events?

Using it for alerting when someone disables an AD account: Would like it to also email those remaining 99 events.

Eg:

....

...

...

.

.

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Logged: 02/01/2016 15:51:24

Event ID: 4725

Level: Audit Success

User:

Computer:xx

A user account was disabled.

Subject:

                Security ID:                         S-1-5-21-3858926159-4103199858-4114485146-44303

                Account Name:                xx

                Account Domain:                              xx

                Logon ID:                             0x24861C

Target Account:

                Security ID:                         S-1-5-21-3858926159-4103199858-4114485146-2369

                Account Name:                 xx

                Account Domain:                              xx

...another 99 events skipped

0 Kudos
0 Replies