Tutorial: Creating a custom report on accounts being locked out
This tutorial gives you a step by step guide how to create a custom report. As an example, we will create a report on all accounts that have been locked out in a particular month. This means we need to filter out events with ID 539 and 644, which are the events which are generated if an account is locked out.
1. Launch the reporter from the start menu and expand the node named "Computer event reports in percentages".
LANguard S.E.L.M. reporter
2. Right click on the main report type node with the name "Computer event reports in percentages" and select "New report…"
General page of a new report
3. Specify a name for the report, which you will be able to recognize in the future and use again to re-generate the report.
4. Now we want to specify that we are only interested in event 539 and 644. Click on the button "Settings…", and a new dialog will be shown.
5. We want to override the default options, so click on the radio box "Only these events".
6. Now Click on "Add…" to specify the event ID's which you want. Click on 'Other event' and enter the event ID 644. Click on OK to add the event ID to the list of ID's to add. Repeat the process for event 539.
Adding custom events
7. After adding both event 539 and 644 to the events to include list, the event ID filter dialog should look like the one below:
Custom settings for the report
All the options in the Domains, Computers and Users pages can be left as is since you have no other required restrictions. Click on OK to confirm the changes and return to the main report page.
8. You can leave the classifications page as is since you are interested in all events irrespective of whether they were categorized as critical, high, medium, low or unclassified security events.
9. Now specify the date range for the report on the Period page. In this case we want to generate the report for all the account lockouts which happened this month. Click OK to generate the report entry.
Specifying the date range
10. All that is left is to generate the report. Right Click on the newly created report name and select "Generate". The report will be generated and the results will be indicated in the report pane. The report will also include details on which computers these events we're generated.
NOTE : all settings will be saved and you will not be required to re-do all of these steps when you want to re-generate the report.
Report showing that the account GFIMALTA\robert generated lockout events on the machines ANITAS and STEPHENC
| 
