Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: group changed "builtin\administrators" security enabled local group

$
0
0

So you're getting an e-mail?

 

  1. Go to nDepth
  2. Under Events, find "InternalRuleFired"
  3. In the fields, find "Extraneous Info"
  4. Drag "Extraneous Info" to the search bar at the top of the nDepth screen
  5. In the field, enter *email*
  6. Search!


The LEM ought to come back with all the times the rules sent an e-mail, and what rules are responsible.  Take a look at those, and if you can figure out which rule and send a screenshot, we can probably find a way to modify it.


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>