|
| | | Junior Member
 
Group: Forum Members
Last Login: 8/12/2009 3:48:02 PM
Posts: 18, Visits: 64 |
| I have an OU in Active Directory called "Former Employees". I would like to get an email if anyone in that group even attempts to login; even if their account is disabled, since they shouldn't be on premises to begin with. I have pumped up audit settings to include all login events but so far I haven't seen a way in the event logs to see if an employee is in that OU.
Anybody got an ActiveScript or something that accomplishes this? |
| |
| | | Forum Guru
Group: Forum Members
Last Login: 10/2/2009 6:52:27 PM
Posts: 72, Visits: 9,166 |
| | You can do this with a passive monitor, just create a new one choose Windows event log then choose a passive monitor (you will need to create it - Here is a link to use for a video on Event log monitors [url=http://www.youtube.com/watch?v=KL4bklLyybc&feature=player_embedded][/url]) then choose an action (This is where you can setup the email to send to yourself) then click finish. |
| |
| | | Junior Member
Group: Forum Members
Last Login: 8/12/2009 3:48:02 PM
Posts: 18, Visits: 64 |
| Bill Farinella (6/23/2009)
You can do this with a passive monitor, just create a new one choose Windows event log then choose a passive monitor (you will need to create it - Here is a link to use for a video on Event log monitors [url=http://www.youtube.com/watch?v=KL4bklLyybc&feature=player_embedded][/url]) then choose an action (This is where you can setup the email to send to yourself) then click finish.
Thanks much Bill. However, my problem is not creating a passive monitor -- I know how to do those easily. My problem is only detecting users who are in a specific AD group. I''ve got a couple hundred accounts in a Former Employees group, and I'd like to get an email if any of them attempt to login. (They couldn't, they're disabled, but it'd let us know they're onsite trying to get in.)
It is not doable for me to go in and code 200 account names in a regex to run against all logins. I hoped someone had an ActiveScript or something that could check the group membership of each login before deciding whether to notify. |
| |
|
|