Create a Search and an Alert for Security Event Viewer log property change events (4378140)

Create a Search and an Alert for Security Event Viewer log property change events

Steps to create a Search and an Alert for Security Event Viewer log property change events.

1. Open the CA Client, Select View> Administrations Task> Configuration> Coordinator. Make sure the SMTP option is  selected an all the necessary fields are filled.
1. From Address
2. Mail Server
2. Click on View> Searches> Shared, and right click on the Shared and select New> New Search
3. The Event Properties of the Select Search is listed in the lower pane.
4. Select What tab> drop down beside +Add> Subsystem> Registry
5. Add Registry key wizards opens.
6. Beside the Path (which is located closer to the lower window), select the three ellipses (…), select the DC, and click on Select button
7. Select Scope as This Object and All the Child Objects, and Select the Registry key HLKM\SYSTEM\ControlSet001\Services\EventLog\Security, HLKM\SYSTEM\ControlSet002\Services\EventLog\Security, and HLKM\SYSTEM\CurrentControlSet\Services\EventLog\Security
8. Click Ok.
9. Select Alert Tab.
10. Select Email under the Alert Configuration.
11. Enter the Email Addresses and Click ok.
12. Click on Alert Enabled and Save.