UIM - Monitor users disconnections from windows sessions

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Is there is any way we can monitor users disconnected sessions in Windows using UIM? 

 

Environment

Release : UIM 20.x

Cause

Guidance

Resolution

If you need to monitor users' account disconnections from a windows server, please deploy the ntevl log probe 

ntevl (NT Event Log Monitoring) Release Notes (broadcom.com)

When a user disconnects from Windows Event ID 4634 is created in the security windows event log:

 

 

So create a security log profile and monitor EventID 4634

 

In this case, when the user "disco" disconnects, the alarm is raised.