How can I setup a notification alert when a user is locked out of Active Directory?
I am using SolarWinds Log & Event Manager 5.4
Thanks
Hi, aca5tle.
We have a NATO5 rule called "User Account Lockout (Updated)" that you can configure to send you an email anytime a user locks himself out. You can also use the same logic to create a filter or nDepth search:
UserDisable.EventInfo = *Account Lock*
If you're not too familiar with LEM, here are some additional details:
For additional information about these steps, see:
I hope this helps.
Phil
There's a few possibilities for this one - the rule might not be firing at all, or if the rule IS firing, you might be missing the email active response tool.
Check out this KB: SolarWinds Knowledge Base :: Troubleshooting LEM Rules and Email Responses for all the details on troubleshooting this problem. The bottom of that KB has additional references, including: SolarWinds Knowledge Base :: How to Configure the Email Active Response Connector which is the most commonly overlooked step in the process.
HTH!
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.