ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
I am not seeing IDS events for "User_Removed_from_Universal_Grp " in Data Center Security even though I am seeing 4757 event in the Windows logs.
Article ID: 170358
Embedded Security Critical System Protection
Critical System Protection
Data Center Security Monitoring Edition
Data Center Security Server Advanced
Customer is using an older IDS baseline detection policy that is broken and needs to upgrade.
Upgrade your IDS baseline detection policy to the latest version will resolve this issue.