Sorry I am aware of the event ID's but I want to distinguish between the two - as management do not care in this scenario about group memberships as such but when someone gets added to a mailing list that they should not be on.
Mark -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of TIROA YANN Sent: 20 February 2006 10:46 To: [email protected] Subject: RE: [ActiveDir] OT: MOM/Auditing Group Membership changes.. Hi, Just tried it, and that works for security groups or exchange Distribution lists. You just have to create a custom rule event with evenid 632 to monitor that corresponds to an add/delete memberships event. Here is a usefull eventID lists provided by Susan Bradley on this list which can help you to monitor the Ids you are looking for. http://www.ultimatewindowssecurity.com/encyclopedia.html Yann -----Message d'origine----- De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de Mark Parris Envoyé : lundi 20 février 2006 11:02 À : ActiveDir.org Objet : Re: [ActiveDir] OT: MOM/Auditing Group Membership changes.. I have done this and it works very well, You need to monitor local, global and universal memberships What I would like to do though is monitor additions to mail enabled groups. Is this possible. Mark -----Original Message----- From: "Wyatt, David" <[EMAIL PROTECTED]> Date: Mon, 20 Feb 2006 09:51:16 To:<[email protected]> Subject: RE: [ActiveDir] OT: MOM/Auditing Group Membership changes.. You can but not with the MOM AD Management pack specifically. You will need to setup a custom alert based on the Event ID (632 I think) that corresponds to a group membership change. You can then get alerted via email. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frank Abagnale Sent: 20 Feb 2006 9:34 To: Active Subject: [ActiveDir] OT: MOM/Auditing Group Membership changes.. Hi, I'm looking to audit group membership changes with some form of alert. Would the MOM AD Management pack allow me to do this? I only mention MOM as the business has bought this without discussing this with IT thanks Frank Yahoo! Mail Use Photomail to share photos without annoying attachments. **************************************************************************** This message contains confidential information and is intended only for the individual or entity named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as an invitation or offer to buy or sell any securities or related financial instruments. GAM operates in many jurisdictions and is regulated or licensed in those jurisdictions as required. **************************************************************************** List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
