Voltar
-
Título
How to create an alert for adding or removing members from a local group. -
Descrição
Have a need to monitor and alert on a local group (administrators) on member servers. -
Causa
An administrator need to create a search that return events for changes made to a local group. This document will provide the steps to create the search. -
Resolução
The following steps will create a search that targets local groups:1. Click the “New” or Plus icon (+) in the button bar menu of the Change Auditor Client search tab to create a new search.2. Enter the desired name in the “Search Name” field of the “Info” tab in the search properties.3. Select the “What” tab and click the “Add” or “Plus” (+) button in the button bar of the search properties.4. Search for or enter a keyword in the Event Class filter to find "Member added to local group" and "Member removed from local group" event classes for local security groups5. Select each and click the “Add” button to move them to the lower section.6. Click “OK” when all event classes are added.7. Still in the “What” tab, click the drop-down arrow to the right of the “Add” or “Plus” (+) button in the button bar of the search properties.8. Select “Subsystem” | “Local Account” from the Context menu9. Select the “This Object” Radio button in the top section of the form.10. Select the Principal Name.11. Click the “Add” button at the bottom of the window to move the selected object into the lower section.12. Click “OK” when Principal Names are added.13. Select the Alert tab
The following steps will create an Alert for the search created:1. Check SMTP2. Enter the email address(s) (or click the ellipsis to find them) for the people who should get the alert3. Make any additional changes for the Custom Email alert and then click OK4. Check Alert Enabled5. Click Save