User login activity for servers

TonicXsonic Member Posts: 2
edited December 2023 in Remote Monitoring

Hi, I would like to know if there is a way to create an alert when there is a user to log in from the managed device. So far i don't see any option in the threshold setting for this.


  • [Deleted User]

    I haven't tried it - but perhaps create a threshold profile and look for this event ID 4264 - The trouble is you probably want to filter it where LogonType=2 and atera does not support that.

    You might be able to use a custom script instead attached to a threshold profile to achieve that, something like

    taken from

    Get-WinEvent -FilterHashtable $filterHt | foreach-Object {
            ComputerName = $ComputerName
            UserAccount = $_.Properties.Value[5]
            UserDomain = $_.Properties.Value[6]
            LogonType = [LogonTypes]$_.Properties.Value[8]
            WorkstationName = $_.Properties.Value[11]
            SourceNetworkAddress = $_.Properties.Value[19]
    echo 1

    and then raise an alert if your script outputs a 1 or something.

    Sorry I cannot give you an exact answer, but I hope that this helps.