Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > LEM Workstation Logon or Logon Failure Activity filter conditions

LEM Workstation Logon or Logon Failure Activity filter conditions

Table of contents

Updated June 7, 2017


This article provides the default conditions used for the Workstation Logon/Logon Failure Activity filter under the Endpoint Monitoring section.


LEM 6.2.1 and later


Name: Workstation Logon/Logon Failure Activity


(OR)1st group{

(AND)2nd group{

UserLogonFailure.LogonType != *blank*

UserLogonFailue.LogonType != Windows:Network

UserLogonFailure.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup*   }

(AND)3rd group{

UserLogon.LogonType != *blank* 

UserLogon.LogonType != Windows:Network

UserLogon.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup*   }



See Default LEM filter conditions on the Web Console Monitor page for a full list of available default filters in LEM.



Last modified