Active Directory id Events

[isanchez]

Dear Team

New Report :

We have to ask to the active directory for the following events.

528 Successful Logon
529 Logon Failure - Unknown user name or bad password
530 Logon Failure - Account logon time restriction violation
531 Logon Failure - Account currently disabled
532 Logon Failure - The specified user account has expired
533 Logon Failure - User not allowed to logon at this computer
534 Logon Failure - The user has not been granted the requested logon type at this
535 Logon Failure - The specified account's password has expired
536 Logon Failure - The NetLogon component is not active
537 Logon failure - The logon attempt failed for other reasons.
538 User Logoff
539 Logon Failure - Account locked out
540 Successful Network Logon
551 User initiated logoff
552 Logon attempt using explicit credentials

AD' has activated all events .

for lansweeper 5.x

Many Thanks

Ivan Sanchez

[isanchez]

Thanks

[Hemoco]

Please refer to this forum thread for a sample report.

[isanchez]

Lansweeper wrote:
Please refer to this forum thread for a sample report.

Please you me one example, because I cannot find it.

[Hemoco]

isanchez wrote:

Lansweeper wrote:
Please refer to this forum thread for a sample report.

Please you me one example, because I cannot find it.

Do you mean you can't access the forum thread? The report it contains is the following:

Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.IPAddress,
tsysOS.OSname,
tblAssets.SP,
tblNtlog.Eventcode,
Case tblNtlog.Eventtype When 1 Then 'Error' When 2 Then 'Warning'
When 3 Then 'Information' When 4 Then 'Success Audit'
When 5 Then 'Failure Audit' End As Eventtype,
tblNtlogFile.Logfile,
tblNtlogMessage.Message,
tblNtlogSource.Sourcename,
tblNtlogUser.Loguser,
tblNtlog.TimeGenerated
From tblAssets
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblNtlog.Eventcode = '55' And tblNtlogSource.Sourcename Like '%ntfs%' And
tblNtlog.TimeGenerated > GetDate() - 7
Order By tblNtlog.TimeGenerated Desc