|Applies To||Envision 3.5.x, 3.7.x|
|Issue||You wish to generate report that show the detail information of the changes for computer account|
You generate the report "Windows - computer Account changes" to look for what changes occur on the computer account. However, in the report you only see the action as "Computer Account Changed". You wish to know what changes occur instead. E.g: Account being created, deleted etc
|Cause||The default report only look looks at some specific Windows event, in particular, event ID, 645, 646 and 647. |
These event IDs doesn?t give details information of what exactly are those changes.
If you like to look at the detail information of the changes, you will need to modify the existing report to look at other event ID. In specific, you need to look at event ID 624, 628 and 630. For your reference,
Event 624 is for user account created,
Event 628 is for user account password being set
Event 630 is for user account deleted
To modify the report to look at these event
1. select the ?Windows ? Computer Account changes? report, then click copy, then modify.
2. After that, leave everything as default until you see SQL query.
3. Change the last part of the query from
Then the rest can stay default. After that the report will show specifically for users account add, delete or password being set
|Legacy Article ID||a42546|