Submit a ticketCall us

Solarwinds & Cisco Live! Barcelona
Join us from the 29th of January to the 2nd of February at Cisco Live 2018 in Barcelona, where we will continue to show how monitoring the network with SolarWinds will keep you ahead of the game. At our booth (WEP 1A), we will demonstrate how SolarWinds network solutions can help. As a bonus, we are also hosting a pre-event webinar - Blame the Network, Hybrid IT Edition with our SolarWinds Head Geek™, Patrick Hubbard on January 24th - GMT (UTC+0): 10:00 a.m. to 11:00 a.m. There's still time to RSVP.

Home > Success Center > Archive > 2017December19 - Deletes > Enabled account rule is also firing for create user events

Enabled account rule is also firing for create user events

Created by Jason Dee, last modified by Jessica Solis on Dec 19, 2017

Views: 715 Votes: 1 Revisions: 5


This article provides brief information and steps to resolve the issue when the rule created to alert you for account enabled events is not firing for create user events.



All LEM versions



The issue is caused when a user account is created in the Active Directory. Windows will immediately follow the create user event with an account enabled event which causes a false positive.



Modify your rule correlations to ignore the account enabled events if it accompanies a create user event. Modify your rule to match screenshot.  Save your changes, and click Activate Rules.






Last modified