This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Alert Trigger for Server 2012

Hi everyone we have been running LEM on several 2008 r2 boxes and we have just started running it on a couple 2012 servers. About 5 or 6 times through the day we get the following notification of an event triggering.

'Group changed "Builtin\Administrators" security enabled local group at 2013-07-15 15:37:33.0 on xyserver.domain.com'


I have found these events in the windows logs but we aren't changing this manually and it's happening on both 2012 servers we are running.


Has anyone come across this and is there a solution or a way to deal with it. I assume it's something that is typical with 2012 as it's happening on both 2012 servers we have.  I prefer not to simply block those alerts as I would like to know if that group is being changed.


Thanks for any help

Mike