Kaseya Community

Alarm on specific logon

  • Apologies if this was covered in an earlier thred but could not find anything via search.

    Is it possible to create an Alarm based on a single NTLM Authentication? I am specifically looking to create an Alarm when a certain User Account logs into any Workstation or Server.

    Thanks in advance.

    Legacy Forum Name: Alarm on specific logon,
    Legacy Posted By Username: jholbird
  • Easiest way is to enable logon/logoff auditing on the server and monitor for the event that's created in the event log if you don't mind a ton of events or if it's a small network.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: Intech-Jason
  • [QUOTE=Intech-Jason;61376]Easiest way is to enable logon/logoff auditing on the server and monitor for the event that's created in the event log if you don't mind a ton of events or if it's a small network.[/QUOTE]

    One should be able to monitor the audit logs for a specific user, mind you if the network has multiple DC's you'll need to have the alert on all of them, not just the primary.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: thirteentwenty
  • Thanks for the input.

    I ended up creating an Agent Procedure to dump the Security Log to a .txt, parsed for the username, and notified if it was found.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: jholbird