TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
We are using server sensors on WinNT, and would like to monitor event ID 560 in the security event log. Our rule works fine for every other event ID except for event ID 560. We have confirmed that the events are being written to the logs. Any ideas would be appreciated. Has anyone else had any luck using these rules? Thanks Chris R. Cunningham Wilmington Trust
