Event ID

Event ID

Our management currently wants a report for disabled accounts attempting to log in, but ADAudit only has a report for disabled/expired/locked out. I have attempted to modify that report to just show instances with Event Code 2645, but I'm not getting any hits for it. 

Has anyone else run into this issue? 

                New to ADSelfService Plus?