Submit a ticketCall us

Get a crash course on Network Monitoring delivered right to your inbox
This free 7-day email course provides a primer to the philosophy, theory, and fundamental concepts involved in IT monitoring. Lessons will explain not only how to perform various monitoring tasks, but why and when you should use them. Sign up now.

Home > Success Center > Log & Event Manager (LEM) > LEM Workstation Logon or Logon Failure Activity filter conditions

LEM Workstation Logon or Logon Failure Activity filter conditions

Table of contents

Updated June 7, 2017

Overview

This article provides the default conditions used for the Workstation Logon/Logon Failure Activity filter under the Endpoint Monitoring section.

Environment

LEM 6.2.1 and later

Detail

Name: Workstation Logon/Logon Failure Activity

Conditions:

(OR)1st group{

(AND)2nd group{

UserLogonFailure.LogonType != *blank*

UserLogonFailue.LogonType != Windows:Network

UserLogonFailure.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup*   }

(AND)3rd group{

UserLogon.LogonType != *blank* 

UserLogon.LogonType != Windows:Network

UserLogon.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup*   }

}

 

See Default LEM filter conditions on the Web Console Monitor page for a full list of available default filters in LEM.

 

 

Last modified
17:09, 6 Jun 2017

Tags

Classifications

Public