[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Email Notification when Domain Controllers record event.

Posted on 2011-10-04
8
Medium Priority
?
478 Views
Last Modified: 2012-05-12
I would like my system administrators to recieve an email everytime a device joins our domain.  I  know how to set up email notifications from my Server 2008 R2 DC's event logs.  My difficulty is tracking down the pricise event ID that is given when a new device ( be it a VM, workstation, or server) joins our domain.  Does anyone know of this event ID.  I do have permissions to edit the Group policy to affect security settings.  I have recently changed my default domain controller policy settings to log Privilege Use success audits with the hope that joining a device to to domain would throw an event log on my DC.  No luck.  I can't find any refference to a new device being added to my domain.

I would appreciate any direction provided.
Thanks,
JP
0
Comment
Question by:jp415
  • 4
  • 3
8 Comments
 
LVL 35

Accepted Solution

by:
Joseph Daly earned 1500 total points
ID: 36912984
I believe you will want to search for Event is 4741 for a computer and 624 for user accounts.

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4741

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=624

There are also others for changes made etc. Here is the complete list.

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 36913024
0
 

Author Comment

by:jp415
ID: 36913078
As of right now my Domain controllers aren't logging any event 645.  Do you know what audit policy needs to be set to record event 645?

0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LVL 47

Expert Comment

by:Donald Stewart
ID: 36913112
Any 4741 events as xxdcmast mentioned ....I posted a little quick.....645 is for 2003 and 4741 is 2008
0
 

Author Closing Comment

by:jp415
ID: 36913467
The event log 4741 will work.  I've attached a email action to that event id that notifies SA's of a new device.  The event is actually generated when a new device is prestaged in AD, not when some admin joins a computer to the domain.
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 36913938
Glad I helped......
0
 

Author Comment

by:jp415
ID: 36914009
My bad, I'll be sure to remember dstewartjr.  Next time you'll have an unfair advantage
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 36914028
Ahhhh....Dont worry 'bout it  :)
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Welcome to my series of short tips on migrations. Whilst based on Microsoft migrations the same principles can be applied to any type of migration. My first tip Migration Tip #1 – Source Server Health can be found listed in my profile here: http:…
Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Suggested Courses

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question