1 Reply Latest reply on May 23, 2016 3:27 AM by jhynds

    Help with local admin filter


      What is the event name if i want to track new/deleted local admin? Would event name NEWGROUPMEMBER with DestinationDomain of "builtin" work? Basically anytime a user is added to the "builtin/administrator" i would like to see it.