Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: Reports Manager pulling inforamtion from AD

$
0
0

You're definitely on track for one of the things that you would want to check.  I would start by creating a test event and then searching for it in nDepth.  This serves to verify that the event is actually arriving to the LEM and can help you narrow your focus from there.

 

For example, I had a test account that was overdue for deletion so I removed it from the domain to trigger an event.  The report that I ran was the "Change Management - General Authentication: Domain Events - Delete Domain Member" report which is where I found the event.  I first verified it was in nDepth and then ran the report (just as this was the first time).

 

From there, if you're seeing the event in nDepth, but not the Reports console it could be too narrow of a time field or something else (though you seem to indicate other Reports work fine), but if you're not seeing your events in nDepth that's where you would want to check your auditing policy, make sure the event is in the Security logs and see if there are any issues with Agent communication and the LEM.


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>