How can I find users that as been enabled in Active Directory (EventID 4722) and was not disabled anymore? I mean, no EventID 4725 generated after 4722 until now.
Did you have the eventID in a single field available?
Yes. Is a normal Windows Log forwarded by NXLog to Graylog.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.