Hello.
How can I find users that as been enabled in Active Directory (EventID 4722) and was not disabled anymore? I mean, no EventID 4725 generated after 4722 until now.
Did you have the eventID in a single field available?
Yes. Is a normal Windows Log forwarded by NXLog to Graylog.