type "evntwin" in the run window or from a cli. The app comes in nt/2k/2k3 by default.
Config type - check custom Then click edit on the right and you will be given a list of items to choose. Essentially a library of every windows event possible including app specific stuff based on your os image. Good luck! James McGovern Amann Network Technician Lead Georgia State University "Complexity is the process by which the obvious is obscured by the irrelevant." -HSW >>> [EMAIL PROTECTED] 10/12/05 9:37 AM >>> The first thing I have done is search for 'eventwin.' I found a single knowledgebase article on Microsoft's web site that referred to it, but not where to get it. HP has several references to it, and many other sites talk about eventwin and eventcmd. I found no reference to where to get it from. I searched three servers, and my computer (which ahs the Windows 2003 resource kit) but not a single hit on eventcmd or eventwin. Can you tell me where to find this tool please? --Bruce D. Meyer -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Thursday, September 15, 2005 10:11 AM To: [email protected] Subject: RE: [WhatsUp Forum] SNMP Trap (Windows user accounted locked out) I have it working Bruce. Using eventwin on the Windows server, you need it setup to send traps based on event id 644. Then you need to have WUP set up to listen for that trap from the server and notify on it. I send an email out to the admins using the following layout. Subject: User Account locked out on %Device.HostName. Body: User account locked out: %PassiveMonitor.Payload.msSoftware.13.1.9999.6.0 This give a nice concise email with the information needed. Tim -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Meyer, Bruce Sent: Thursday, September 15, 2005 8:32 AM To: '[email protected]' Subject: RE: [WhatsUp Forum] SNMP Trap (Windows user accounted locked out) Jonnathan, I just read your question. Did you ever get this working? This would be a great feature to have. --Bruce Meyer -----Original Message----- From: Bryan Harrell [mailto:[EMAIL PROTECTED] Sent: Monday, August 29, 2005 3:41 PM To: [email protected] Subject: Re: [WhatsUp Forum] SNMP Trap (Windows user accounted locked out) WUG must access the NT server you are trying to monitor with administrative rights. If you loginto your WUG box and then try to admisnister the box remotely from there, if it denies you access to read the security logs thru event viewer, then you must add an administrator account to the box/domain that WUG can use to read the event logs. >>> [EMAIL PROTECTED] 08/29/2005 3:20:56 PM >>> I am trying to setup WUG to send out a notification when a user account is locked out. I have used the "evntwint.exe" util to setup the trap generation and verified the trap was sent to the wug box by using a sniffer program. I just can't figure out why wug will not generate the notification. Both SNMP services are running on the WUG box. Please help. Jonathan Brown Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
