Showing results for 
Search instead for 
Did you mean: 
Level 7

McAfee Point Product that Monitors Windows Event ID 528

A Customer inquired about which McAfee point product has the ability to monitor Windows event ID 528.  Event 528 is logged whenever an account logs on to the local computer, except for in the event of network logons (see event 540). Event 528 is logged whether the account used for logon is a local SAM account or a domain account.  They would like to have these events processed by EPO so that an auto-response notification can be sent via e-mail to desinated recipients.  Can this be accomplished?  KB54677 has a listing of all McAfee Point Product generated Event IDs listed in ePO, but I don't see anything like this listed and presume that none of our products monitor for this Windows event.  Comments?

0 Kudos