none
Event Comb for Windows Server 2008 R2

Answers

  • You can still use the old version of EventCombMT for Windows 2008 R2 Domain Controllers. Just have to add EventID 4740 to the search, because Windows Server 2008 log the event with ID 4740 for user account locked out.

    Here is the complete list of new security event IDs in Windows Server 2008: http://support.microsoft.com/kb/947226

     

    Regards,

    -ferry-

     

    • Marked as answer by martit01 Friday, July 30, 2010 10:16 PM
    Tuesday, July 27, 2010 10:15 AM

All replies

  • You can still use the old version of EventCombMT for Windows 2008 R2 Domain Controllers. Just have to add EventID 4740 to the search, because Windows Server 2008 log the event with ID 4740 for user account locked out.

    Here is the complete list of new security event IDs in Windows Server 2008: http://support.microsoft.com/kb/947226

     

    Regards,

    -ferry-

     

    • Marked as answer by martit01 Friday, July 30, 2010 10:16 PM
    Tuesday, July 27, 2010 10:15 AM
  •  

    Hi,

     

    Thank you for visiting the Microsoft forum. This forum focuses on Perfmon and diagnostic tools. I am moving your question to the moderator forum ("Where is the forum for..?"). The owner of the forum will direct you to a right forum.

     

    Thanks.

    Bruce Adamczak

    Monday, August 30, 2010 5:14 PM