Some Window events have a second line in the event description (e.g. Windows 646). My LEM generates an email with the following:
The User xxxxx had made the following modification:
User FLEET$ account Computer account "AD\FLEET$" changed: "-".
I would like to get the second line of the event description to add to the email.
Does anyone know of a way of capturing this data?
(I'm new to LEM. Haven't found any discussions to cover this topic yet)