When I try to scope this I have the option for the class which is fine (Windows Domain Controller) but I just want to the alerts associated with a specific rule I created for letting me know when a particular non-security group is changed (event id 5136 and a description setting). How do I do this?
Target the class ‘Windows Domain Controller’
Then under criteria use:
Name like ‘%event id 5136%’
– or what ever is relevant for the rule you have created. % is wild card and they can be removed if you are specific with the rule subject title
oh ok. I was hoping you didn’t have to do that search as that just adds a little bit extra waiting time. Thanks. G