Kaseya Community

accounts getting locked ticket or alarm

  • I want tickets or alarms to be created when my accounts get locked on any machine or get advance notification that they are going to lock please help urgently.

  • One of the Kaseya Sample Event Log Sets should cover this for you. The event set is called "ZC-CM1-E12 Security Logon Events" and it monitors the log for the following:

    Source Category Event ID User Description

    Security * 529 * *Unknown user name or bad password*

    Security * 531 * *Account currently disabled*

    Security * 532 * *The specified user account has expired*

    Security * 535 * *The specified account*password has expired*

    Security * 536 * *The NetLogon component is not active*

    Security * 539 * *Account locked out*

    Security * 627 * *Change Password Attempt*

    Of course, you should be able to add a new Event Set to look for Event ID 539 to only monitor for Lock-Outs.  Good luck!