I think this the event you are looking for: Security 629 Information User Account Disabled:%n\r\n%tTarget Account Name:%t%1%n\r\n%tTarget Domain:%t%2%n\r\n%tTarget Account ID:%t%3%n\r\n%tCaller User Name:%t%4%n\r\n%tCaller Domain:%t%5%n\r\n%tCaller Logon ID:%t%6%n\r\n
Regards: Scott Wright -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Wednesday, August 11, 2004 2:05 PM To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] WinEvents I am wondering what events you are looking for to determine whether an account is locked out or not? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Dennis Sent: Wednesday, August 11, 2004 12:09 PM To: [EMAIL PROTECTED] Subject: [WhatsUp Forum] WinEvents I am monitoring Windows2000 and 2003 Domain Controllers in about 10 countries using Whatsup Gold 8.03HF1. I recently added an Event to look for Locked out Accounts - in other words for Windows users who exceed their password limit and lock their domain account. All is working well, except I do run into some interesting problems with stability If the Event Log is cleared on the destination machine, then new events do not get polled by WMI from the Whatsup Server. Restarting Whatsup Gold (running as a service with domain admin rights) and/or restart the WinEvent.exe service on the server allows any NEW events to be properly captured. Has anyone else run into the problem wherein Whatsup Gold 8.03HF1 appears to get into a state where new Windows Logs do not get captured ? On a side note - I also run into problems where certain maps refuse to poll until I restart the main Whatsup service. For example, 25 maps may be running just fine, but any devices in the "stale map" do not get polled (the map is active and each device is active). The way we can see this is when we add new devices to the map, they never start polling. Regards, Jason Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
<<attachment: winmail.dat>>
