Scanning Group and Account Changes from the Event Log

[pjbate]

Hi there,

I am trying to capture user account and group changes using Lansweeper. I'd like to be able to report on the following event ids:

Event ID 608 – User Right Assigned
Event ID 609 – User Right Removed
Event ID 626 – User Account Enabled
Event ID 628 – User Account Pass set
Event ID 630 – User Account Delete
Event ID 631 – Global Group Created
Event ID 632 – Global Group Member Added
Event ID 633 – Global Group Member Removed
Event ID 634 – Global Group Deleted
Event ID 635 – Local Group Created
Event ID 636 – Local Group Member Added
Event ID 637 – Local Group Member Removed
Event ID 638 – Local Group Member Deleted
Event ID 639 – Local Group Changed
Event ID 641 – Global Group Changed
Event ID 642 – User Account Changed

I know there is some history reporting available but it doesn't grab everything (e.g. I removed an accoung from a group this morning but don't see the event 633 at the time, but I do see other events.

Is it possible to capture these events too and if so how?

Thanks,
Peter

[Hemoco]

To keep your database size within reasonable limits while scanning information events, you could lower the number for "Delete eventlog entries after". This setting can be found in the configuration console under Your Scanning Server/Options/Scanning & Cleanup Options.

[pjbate]

Thanks for the pointer. I am collecting logs now and have not yet broken the database.

Cheers,
Peter

[Hemoco]

In the configuration tool, click on the scanning server, tab options.
There you can select "information events" to be scanned.
(don't blow up your database)