MonitorWare Knowledge Base

I am setting up my system to monitor user logons, Failed logons and disabled accounts.

What are the event IDs that I should use in the filters.

Also. Will the user IDs show up in the logs?

Hello,

Following are the event ids that you requested

User Logons -> Event ID = 528
For details of Event ID 528 see:
http://www.monitorware.com/en/events/details.asp?details_id=1030

Failed Logons -> Event ID = 529
For details of Event ID 529 see:
http://www.monitorware.com/en/events/details.asp?details_id=3

If you are asking about Failed Logons due to disabled Accounts, then you are looking for -> Event ID = 531
For details of Event ID 529 see:
http://www.monitorware.com/en/events/de ... tails_id=5

If you look into the details by clicking on the above links, you will see that in all of these events you DO have the user name.

I hope it answers your question. If you have any other question, please feel free to contact us.

Best Regards
Wajih-ur-Rehman
Adiscon