Which security events does the AD Agent respond to?

This article applies to:

• R3000 
• AD Agent

Question:

• Which security events does the AD Agent respond to?

Information:

When The AD Agent scans through the AD security logs, it will look for logon and logoff events generated by users, and have the R3000 set/remove profiles based on this.  Specifically, the Agent will respond to events with event ID 672 and 673.  If the AD security logs do not contain any events of this ID, then the Agent will not perform any authentication actions.