Event ID's

[techierich]

Hi All,

I have auditing setup up and was wondering if anyone could maybe tell me the event ID's for the following:

Event ID for who enables and disables user accounts. I want to try keep an eye on who is enabling user accounts when they are becoming disabled.

Also i have a security group and was wondering if there is an event ID that i can monitor so i know what user is editing this group e.g. adding new users to this group.

Any help or suggestion would be vreatly appreciated.

Cheers,
Rich.

 

[itsp1965]

From the list of audit entries, I would guess that the following should be the one;
642 User account changed

Hope this helps.