Event ID 4722 (enabled), 4725 (disabled), 4726 (deleted) are not visible in the output file

EvotecIT / PSWinReporting

This PowerShell Module has multiple functionalities, but one of the signature features of this module is the ability to parse Security logs on Domain Controllers providing easy to use access to AD Events.

MIT License

705 stars 70 forks source link

Event ID 4722 (enabled), 4725 (disabled), 4726 (deleted) are not visible in the output file #67

Closed Mumprecht closed 2 years ago

Mumprecht commented 2 years ago

I run the script with the paramter -report ADUserChanges. I see only the log entries with the EventID 4720 and 4738. Do I use the wrong key parameter? Kindly Urs

PrzemyslawKlys commented 2 years ago

ADUserStatus -> Events = 4722, 4725, 4767, 4723, 4724, 4726 ADUserChanges -> Events = 4720, 4738