Not sure, but I'd think they would just plug it into the security log of the event view. They may have a second one that details what cmds are being run, check their (MS) knowledge base.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.