Admon Alerts

[benf]

Hi, I am not sure what is going wrong, but we have one of our managed accounts that is local admin on all machines but Admon keeps creating tickets that the account has been modified/tampered. I am not sure if I have to manually 'add' the account on each device first? Which doesnt seem to make sense.

Is there anyway to check logs on why the Admon keeps thinking something is being add/remove when nothing is changing?

thanks

[Cubert]

You should stop all monitoring on that client via plugin, then reset the monitors back on. This will cause a refresh of the monitored list which should now include that admin user.

[benf]

Okay thanks, I have it off now, and will try that. I did notice that it did not 'load' all the accounts that were already in there on all systems to begin with, so maybe I missed something.

I will try again