Event ID 624 monitoring
We are monitoring event 642 on our DCs for disable accounts for audit reasons and it works very well. However, when we try to fire off an event on ID 624 for account creation, we never see alarm or an email stating the condition was met. The event log rule is only set to look for the event id but have tried a combination of options in the rule to try and get it to work.