4.1 Configuring the Event Monitor Scope
-
In the Admin Client, click the tab.
-
Click .
-
In the pane, click the arrow to view the Active Directory containers.
-
Drag to the and panes, the containers, subcontainers, and groups you want included and excluded respectively.
Remember that the Builtin, Foreign Security Principals, Managed Service Accounts, Program Data, and System containers are excluded automatically.
Action
Result
Dragging one or more containers or groups to the pane.
Specifies that those selected containers and their subcontainers, and groups and their nested groups will be monitored by the Event Monitor, while all other containers and groups will not be monitored.
Dragging one or more containers or groups to the pane.
Specifies that those selected containers and their subcontainers, and groups and their nested groups will not be monitored by the Event Monitor, while other containers and groups residing at the same level of the excluded container and group in the AD forest or domain, will be monitored.
-
Click .
4.1.1 Example Scenarios
The following are example scenarios of Event Monitor scoping that might help you configure your Event Monitor scope. For expanded information, see Section G.0, Event Monitor Scope.
Figure 4-1 Containers Specified to Include
In the example in Figure 4-1, the Event Monitor will monitor only the events that pertain to the Dynamics and Users containers, including their subcontainers.
Figure 4-2 Container Specified to Exclude
In the example in Figure 4-2, the Event Monitor will monitor all containers except for the London subcontainer.
Figure 4-3 Containers Specified to Include and Exclude
In the example in Figure 4-3, the Event Monitor will monitor the Dynamics container and all of the subcontainers in the Dynamics container, with the exception of the Groups subcontainer in Munich. It will also exclusively monitor the Domain Admins group and exclude all other groups.