cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
NoraD
Engaged Sweeper II
Hi

I have a Scheduled Eventlog Scanning task against my Domain Controllers (W2008 R2) each 15 minutes, and I enabled the option "Scan Success audit events" in Server Options. After that, although I began to receive events from my DCs, I can't see the EventID 4740 (Source: Microsoft Windows security) that tells me when an user account was locked out in Active Directory.

I don't understad what happen because the event 4740 is a Sucess Audit Event too.

Any idea?

Thanks a lot !!!

1 ACCEPTED SOLUTION
Daniel_B
Lansweeper Alumni
Changing your settings under Configuration\Server options, section Eventlog scanning, will only have effect for events being logged after the time you changed the setting. You won't be able to retrieve events logged more than 24 hours ago.

View solution in original post

1 REPLY 1
Daniel_B
Lansweeper Alumni
Changing your settings under Configuration\Server options, section Eventlog scanning, will only have effect for events being logged after the time you changed the setting. You won't be able to retrieve events logged more than 24 hours ago.