Return
-
Title
Alerts reporting on LASTLOGON attribute changes for Domain Controllers -
Description
I have Alerts created and running successfully for years. Recently Upgraded a Domain Controller to Agent version 6.5.152 And Account that authenticates to that DC and has a an Alert, will generate an alert for the LASTLOGON attribute and send the Owner an Email. The previous Agent version (6.0.181) on the other DC's does not do this. How do I disable this Alert in the Search. I want the alert to notify of the Owner of changes such as Password changes\Lockouts\name changes etc..but not Mundane things like LastLogon attribute. -
Cause
The Agent created an issue in 6.5 and 6.6 where these AD ‘housekeeping’ (lastLogon + lastLogonTimestamp + badPwdCount) attributes would be audited IF you added them via ‘unmonitored attributes’. In 6.0 (and earlier) if you had them added via ‘unmonitored attributes’ they would be ignored. -
Resolution
These unmonitored attributes should be disabled by removing them from ‘unmonitored attributes’ screen from the user (and possibly computer) object classes until you can apply the appropriate hot fix. If you leave these attributes enabled you will need to be extremely cautious as the chances of exploding the database size is extremely high. It is extremely important you do not try and continue to audit those attributes on computer object class, as they will in short order explode the database size.These AD ‘housekeeping’ attributes will be shut off again in 6.Hotfix 6.5.167+ and 6.6.653+ released with:TF00418617 - 'After upgrading to Change Auditor 6.5, auditing of logon attributes causes an excessive amount of events'.