Submit a ticketCall us

Training ClassThe Orion® Platform Instructor-led Classes

Provided by SolarWinds® Academy, these trainings will introduce users to the Orion Platform and its features, management, and navigation. These courses are suitable for users looking to discover new tips, tricks, and ways to adapt their Orion products to better suit their monitoring needs:
Deploying the Orion Platform
Configuring Orion views, maps, and accounts
Configuring Orion alerts and reports

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > LEM Workstation Logon or Logon Failure Activity filter conditions

LEM Workstation Logon or Logon Failure Activity filter conditions

Table of contents

Updated June 7, 2017


This article provides the default conditions used for the Workstation Logon/Logon Failure Activity filter under the Endpoint Monitoring section.


LEM 6.2.1 and later


Name: Workstation Logon/Logon Failure Activity


(OR)1st group{

(AND)2nd group{

UserLogonFailure.LogonType != *blank*

UserLogonFailue.LogonType != Windows:Network

UserLogonFailure.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup*   }

(AND)3rd group{

UserLogon.LogonType != *blank* 

UserLogon.LogonType != Windows:Network

UserLogon.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup*   }



See Default LEM filter conditions on the Web Console Monitor page for a full list of available default filters in LEM.



Last modified