You generate the report "Windows - computer Account changes" to look for what changes occur on the computer account. However, in the report you only see the action as "Computer Account Changed". You wish to know what changes occur instead. E.g: Account being created, deleted etc
These event IDs doesn?t give details information of what exactly are those changes.
If you like to look at the detail information of the changes, you will need to modify the existing report to look at other event ID. In specific, you need to look at event ID 624, 628 and 630. For your reference,
Event 624 is for user account created,
Event 628 is for user account password being set
Event 630 is for user account deleted
To modify the report to look at these event
1. select the ?Windows ? Computer Account changes? report, then click copy, then modify.
2. After that, leave everything as default until you see SQL query.
3. Change the last part of the query from
'Security_645_Security','Security_646_Security','Security_647_Security'
To
'Security_624_Security','Security_628_Security','Security_630_Security'
Then the rest can stay default. After that the report will show specifically for users account add, delete or password being set
Related Articles
Schedule Reports doesn't show at a location it mean to be Number of Views Generate a report of licensing limits for RSA Authentication Manager 8.3 and higher Number of Views Software Token Profile is required to deploy software token error when running RSA Authentication Manager Bulk Admin Number of Views AIX - Syslogd flag -n should not be used (AIX event source not discovered) Number of Views Why are there N/A's seen in BackOffice Cases Transactions and Reports? Number of Views
