Hi
I am trying to create a rule that generates an alert and send a notification when an event occurs in the active directory; i.e i want to have a notification when an AD user is created...
i have tried to do it many times with no luck
What i noticed is that when i go to configure the rule to select the computer name and the type of event source which is security in my case and i select the event ID and applies the changes.
I chose my primary domain controller hostname as computer name and i checked names and everything is okay
but what is weird for me that the computer name is always taking the scom server hostnameas computer name .
Does scom by default collects security events from a remote computer differen from the management server??
If yes what am i missing??
if no do i have to edit the xml configuration of the default management pack that i am using in my rule??
does allow agent proxy has to do with this??
simply i want a rule that gathers events from a remote machine
Please i need support because i am stuck here and i am out of ideas how to do it .
10x in advance