User login activity for servers
TonicXsonic
Member Posts: 2 ✭
Hi, I would like to know if there is a way to create an alert when there is a user to log in from the managed device. So far i don't see any option in the threshold setting for this.
Tagged:
0
Comments
-
I haven't tried it - but perhaps create a threshold profile and look for this event ID 4264 -
The trouble is you probably want to filter it where LogonType=2 and atera does not support that.You might be able to use a custom script instead attached to a threshold profile to achieve that, something like
taken from
Get-WinEvent -FilterHashtable $filterHt | foreach-Object { [pscustomobject]@{ ComputerName = $ComputerName UserAccount = $_.Properties.Value[5] UserDomain = $_.Properties.Value[6] LogonType = [LogonTypes]$_.Properties.Value[8] WorkstationName = $_.Properties.Value[11] SourceNetworkAddress = $_.Properties.Value[19] } } #output echo 1
and then raise an alert if your script outputs a 1 or something.
Sorry I cannot give you an exact answer, but I hope that this helps.
1
Topics
- All Topics
- 39 Getting started
- 23 Read before posting
- 8 Meet and greet
- 209 General
- 58 News and announcements
- Swag
- 1 Roadmap updates
- 63 Resources
- 8 Knowledge Base
- 11 Webinars
- 1 Shared Script Library
- 1 Blog
- 14 Pro Tips
- 26 Got an idea?
- 1 ActionAI
- 1 Copilot
- 116 Remote Monitoring and Management
- 76 Remote Monitoring
- 23 Patch Management
- 85 Professional Services Automation
- 51 Helpdesk
- 16 Billing
- 17 Reporting
- 32 Integrations & add-ons
- 18 Integrations
- 10 Add-ons
- 92 Scripting and automations
- 55 Scripts
- 27 Automations