AnsweredAssumed Answered

Account missuse

Question asked by Tom van Gessel on Jul 3, 2017
Latest reply on Jul 4, 2017 by Eric Partington

I'm trying to create an alert and report for situation where a user is changing his privileges by impersonating another user/account.  We  have alert/ on users going in as a service account or misusing  a colleagues account.

I was hoping to  use a query as usr.src != usr.dst  but this does not seem to work as the syntax does not allow this

How can i do this.

Outcomes