Email Notification when Domain Controllers record event.

I would like my system administrators to recieve an email everytime a device joins our domain.  I  know how to set up email notifications from my Server 2008 R2 DC's event logs.  My difficulty is tracking down the pricise event ID that is given when a new device ( be it a VM, workstation, or server) joins our domain.  Does anyone know of this event ID.  I do have permissions to edit the Group policy to affect security settings.  I have recently changed my default domain controller policy settings to log Privilege Use success audits with the hope that joining a device to to domain would throw an event log on my DC.  No luck.  I can't find any refference to a new device being added to my domain.

I would appreciate any direction provided.
Thanks,
JP
jp415Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Joseph DalyCommented:
I believe you will want to search for Event is 4741 for a computer and 624 for user accounts.

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4741

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=624

There are also others for changes made etc. Here is the complete list.

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DonNetwork AdministratorCommented:
0
jp415Author Commented:
As of right now my Domain controllers aren't logging any event 645.  Do you know what audit policy needs to be set to record event 645?

0
Cloud Class® Course: Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

DonNetwork AdministratorCommented:
Any 4741 events as xxdcmast mentioned ....I posted a little quick.....645 is for 2003 and 4741 is 2008
0
jp415Author Commented:
The event log 4741 will work.  I've attached a email action to that event id that notifies SA's of a new device.  The event is actually generated when a new device is prestaged in AD, not when some admin joins a computer to the domain.
0
DonNetwork AdministratorCommented:
Glad I helped......
0
jp415Author Commented:
My bad, I'll be sure to remember dstewartjr.  Next time you'll have an unfair advantage
0
DonNetwork AdministratorCommented:
Ahhhh....Dont worry 'bout it  :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.