I have an action that will disable local windows accounts, but I need to get proof they were disabled, is there a way to get a log setup that I can open from the IEM server with the console or get the results in a web report?
I have to do the same for deleting IDs and I have an action that does that, but I need the log file?
If you can output to a log file the results, you can query them with relevance. This goes for any plain text file, not just logs.
You can also audit which accounts are NOT disabled and have that as part of the auditing and reporting.
You might also be able to use relevance to report on accounts that are disabled. I’m not sure how to do that, but it is likely possible.
There is a difference between proving that the action ran and disabled the account vs checking the ongoing state of the machine longterm to make sure it remains disabled.
Can you share the action script here !