Some of my customers want to know if there have been any logons outside normal hours. With my previous NinjaRMM I used to have all INTERACTIVE logon events emailed to me. I’m rethinking this a bit with Syncro. I wonder if there is a way to monitor the interactive logons and email them to the specific customer instead of me. That way I’m not inundated with logon events, nor do I need to spend mental bandwidth looking over them. Another thought is to monitor interactive logons outside normal 8am-6pm business hours and send those, instead. It might be nice to have it also log an entry into the Asset’s recent Activity log.
The Event ID is 4624 and the Logontype is 2 in the event. While I can see how to monitor a specific Event ID, Syncro would notify of all Logontypes, which would inundate with all logons. I want to filter it on Logontype 2 only. Thoughts? Ideas?
Thanks in advance.