I did review the pdf http://web.swcdn.net/creative/pdf/techtips/SW_TP_LEM_How_To_Monitor_User_Logon_Actions.pdf
My question relates specifically to monitoring windows remote desktop logins and subsequent actions....
would LEM also be able to monitor these actions?
For instance, a windows server node was rebooted this afternoon and we
would like to poll last remote desktop user to identify who rebooted the node.
Is there a way to incorporate the monitored activity into the 'node rebooted' alert under 'Advanced Alert configuration'?
For instance
nobody@solarwinds.samuelmerritt.edu (ip address) node rebooted (insert name of login id from LEM here) timestamp of event