you could report on the event ID:
30006 Self Recovery Event
30007 Self Recovery Invalidated Event
I use 30005 (Administrator Recovery Event) to report on how many recoveries per day our support does. Its not a real time report of course, but it works well.
Any way to know whether it succeeded or failed? Those ID's seem to just tell me a recovery was attempted.
not exactly. the full decription of the IDs from kc are as follows:
30006 - This event is reported in ePO for every successful Self Recovery.
30007 - This event is reported in ePO whenever the Self Recovery is invalidated after a fixed number of unsuccessful login attempts.
So it looks like you could have a situation that a user could attempt a self recovery and fail and then go to admin recovery and it would only show up as an admin recovery. unless you lock out self recovery after 1 attempt.
Hope that helps clear it up
Thats the info I wasn't able to find. Much appreciated.