|
|
|
Forum Newbie
Group: Forum Members
Last Login: 5/17/2016 3:35:41 PM
Posts: 1,
Visits: 0
|
|
| Is there value in classifying WID 4743 as a security event? We mainly see these when we're dealing with popping computers in and out of the domain. We have fairly tight controls on domain admins thus we're not worried about computers disappearing. We're trying to whittle down what WIDs we alert for.
|
|
|
|
|
Supreme Being
Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237,
Visits: 0
|
|
| I think the value in this event is purely operational. You may want to track assets that are deleted and created. From a security standpoint I don't know of an attacker activity that may generate this event.
|
|
|
|