Need a SCOM alert when perticular user tries to log on to targeted servers.

Question

Hello all,

We are trying to implement a rule based alerting system that notifies user logon's for "Local-Admin" users , targeting all the monitored servers.

To test the same , we have created a rule as follows with personal credentials ( server login credentials).

we are able to generate alerts upon user log on , but we are unable to see logged on user details in the alert as well as event viewer security logs for event ID 4624.
after logging into the server, several (50) new entries are being generated in the event log and the same is being reflected in SCOM console.

Please assist us to proceed further.

Sushanth S K

Answer 1

Hi all,

the event is the right one. The only thing that needs to be done is the paramter mapping. There are two links that can help you do that. Link Nr.1 is from Kevin Holman:

Authoring rules for Windows 2008 events, and how to cheat
https://kevinholman.com/2009/02/24/authoring-rules-for-windows-2008-events-and-how-to-cheat/

and link Nr.2 is from the Q&A forums here (in particular the answer of Crystal):

Server Logon Monitor in SCOM 2016
https://learn.microsoft.com/en-us/answers/questions/389856/server-logon-monitor-in-scom-2016.html

This one will surely help also:

SCOM monitoring for event ID 4624
https://social.technet.microsoft.com/Forums/en-US/8ade29fd-08df-4d92-8b9b-c02eec2902d9/scom-monitoring-for-event-id-4624?forum=operationsmanagerauthoring

I hope I was able to help.

----------

(If the reply was helpful please don't forget to upvote or accept as answer, thank you)
Regards,
Stoyan

Answer 2

That particular user field you're pointing at is the user account generating the event. If you look in event viewer, a lot of events have N/A for the User value. If you want the user id that's logging on, it's probably event parameter 2 that you can get by using $Data/Context/Params/Param[2]$ (in the body of the alert)

if you want to filter for specific user IDs when they logon you can try the event parameter or EventDescription in the filter/criteria for the rule.