0

I have been asked to create a report that gives us the following data in a SCOM report and export to .csv:

  • Timestamp
  • Workstation
  • Account Name
  • Status and Sub Status Codes

I know I'll have to work with Security Log Event ID 4625. We have multiple DC's. The main issue is I have no idea where to get the Workstation from...

Anyone have a idea?

Docschnitzel
  • 61
  • 1
  • 9
  • do you have error code looks like 0x0000..... somthing like that? – serverAdmin123 May 16 '19 at 08:30
  • The error code doesn't really matter here. it's just getting the workstation from which authentication is attempted that I have to figure out :) – Docschnitzel May 16 '19 at 08:38
  • 1
    https://blogs.technet.microsoft.com/antoni/2018/02/03/operations-manager-101-create-an-event-collection-rule-for-monitoring-server-restarts-2/ – Greg Askew May 16 '19 at 11:06

0 Answers0