Navigation: Monitoring with EventSentry > Compliance Tracking >
Acount Management Tracking
|
Navigation: Monitoring with EventSentry > Compliance Tracking > Acount Management Tracking |
|
|
Account management tracking intercepts events related to the creation, modification and deletion of user accounts, groups and computer accounts. Depending on the type of computer this feature is being used, either local or domain accounts will be tracked.
User Account Management
User Creation & Deletion Tracks when user accounts are created or deleted.
User Account Modifications Tracks when user accounts are modified, e.g. when a password is set.
User Status Changes Tracks user status changes, e.g. when a user account is disabled or enabled.
Group Management
Group Addition & Deletion Tracks when groups are created or deleted.
Group Modifications Tracks when groups are modified, e.g. when a global group is changed to a universal group.
Group Membership Changes Tracks changes to the group membership, e.g. when members are added or removed from a group.
Security-Enabled Groups, Distribution Groups Lets you configure which types of groups should be monitored.
Computer Account Management Please note that computer account changes only occur on domain controllers.
Computer Account Creation & Deletion Tracks when computer accounts are added or deleted.
Computer Account Modifications Tracks changes to computer accounts, such as when the password of a computer account is changed.
Retrieve Source IP Address and Computer Name When the logon id contained in the account management event can be linked (correlated) to an earlier logon session, then EventSentry will include the IP address and/or host name. In the case that only the host name or IP address are available, a DNS (reverse) lookup will be performed to gather the missing information.
Due to the nature of DNS lookups, this information should be used with caution and might not be 100% accurate. |
