ACS “Event Count” reports

Here are a couple of ACS reports to show the event count by User, Forwarder, and Event ID.  Just import the .rdl files into a folder in SQL Server Reporting Services.   The first report “Event Count Overview” shows the top 10 Events, Forwarders, and User Names for the specified date range:   Click on…

4

ACS Database Dashboard Report

  Here’s a little report that I put together to get a look at what is going on in the ACS Database.  The report will show: Number of Events in the DB Number of days represented in the DB Max Events Per Day Average Events Per Day Partition Count DB Size DB Free Space Top…

3

ACS: EventSchema.xml changes for Server 2008 Account Lockout Events

Just realized that I haven’t blogged on this yet.  By default, the “Calling Machine” property of Account Lockout events from Windows Server 2008 servers is not entered in the ACS database….this will affect some of the Account Lockout reports that I have previously posted.  Below are the details and the fix:   For Windows 2000/2003…

10

Some Custom ACS Reports

Here are some ACS reports that I’ve written for various customers recently.  If you have ACS installed in the same Reporting Services instance as OpsMgr Reporting, then you can just import the attached Management Pack (CustomACSReports.xml).  Otherwise, you’ll need to import each .rdl file separately. Here is a description of each report, along with some…

30

ACS report: All events for specified user (even more than the built-in version)

A customer recently showed me that the built-in ACS report  “Forensic_-_All_Events_For_Specified_User” seemed to be missing some events.  This report queries the Adtserver.dvall5 view in the OperationsManageAC database and looks for values in the PrimaryDomain\PrimaryUser fields that match the user name that is entered for the report.  The problem that my customer was seeing was that…

0