Event ID
Our management currently wants a report for disabled accounts attempting to log in, but ADAudit only has a report for disabled/expired/locked out. I have attempted to modify that report to just show instances with Event Code 2645, but I'm not getting any hits for it.
Has anyone else run into this issue?