ObjectSid attribute is not monitored by default, you need to do the following.
- Go to Administration Tasks
- Auditing > Attributes
- Choose User and on the bottom browse for objectSid under unmonitored attributes
- add it to the Monitored attributes > add
Now create the search as follow:
- create a new search.
- under what tab press the down arrow next to add and choose event class
- look for ObjectSid under Event class
- add it to the search
Additionally, you can set restrictions.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center