New event id configuring

Question

Hi Igor.Ilyin, 
 Please assist me for gathering the below listed event id in Intrust 11.3. These are new event id's which are related to azure self service password reset. 
 In my domain controller these events getting comitted regularly. I want to gather these logs and store it in repository for futrure audting purpose. 
 I dont want to touch existing gathering jobs. I want to new create new gathering job, scheduled task,policy for collecting these logs.

PasswordChangesValidated 
 10014

PasswordSetsValidated 
 10015

PasswordChangesRejected 
 10016

PasswordSetsRejected 
 10017

PasswordChangeAuditOnlyFailures 
 10024

PasswordSetAuditOnlyFailures 
 10025

PasswordChangeErrors 
 10012

PasswordSetErrors 
 10013

Igor.Ilyin · Answer

Thank you. 
 You can collect this log using two different InTrust UI. 
 The simplified one, this method can collect only new events starting from the current moment: 
 
 Open InTrust Deployment Manager. 
 Switch to Collections tab. 
 New - Windows Collection. 
 Name the new collection, for example Microsoft-AzureADPasswordProtection-DCAgent/Admin. Next. 
 Specify computers from which you want to collect Microsoft-AzureADPasswordProtection-DCAgent/Admin log, by name or using other available methods. Check Install Agents Automatically. Next. 
 On Data Sources and Repository step click Add and set Microsoft-AzureADPasswordProtection-DCAgent/Admin as the name. OK. 
 Uncheck all other data sources in the list. 
 Choose the Repository to collect to or create a new one. Next. 
 Finish the wizard. Wait for configuration applied and then observe the repository you collect to using the Repository Viewer. 
 
 The traditional one, this method can collect also the old events that are already in the log: 
 
 Open InTrust Manager. 
 Create a Site which contains the objects you want to collect Microsoft-AzureADPasswordProtection-DCAgent/Admin log from, or pick one from the existing configuration. 
 Create a Repository for Microsoft-AzureADPasswordProtection-DCAgent/Admin log or pick one from the existing configuration. 
 Go to Quest InTrust Manager | Configuration | Data Sources. 
 Right click the node - New Data Source. 
 Choose Microsoft Windows Events. 
 Set log name to Microsoft-AzureADPasswordProtection-DCAgent/Admin. Set Remote, then local. Next. 
 Set data source name to Microsoft-AzureADPasswordProtection-DCAgent/Admin. Finish the wizard. 
 Go to Quest InTrust Manager | Gathering | Gathering Policies | Microsoft Windows Network. 
 Right click the node - New Policy. 
 Set the name to Microsoft-AzureADPasswordProtection-DCAgent/Admin. Next. 
 Choose the data source Microsoft-AzureADPasswordProtection-DCAgent/Admin from the list. Next. 
 Review the Gathering Settings. Next. 
 Review Event Filtering for Audit DB. Next. 
 Review Event Filtering for Repository. Next. 
 Finish Add Data Source Wizard. Next. 
 Review Configure Filtering. Next. 
 Finish New Policy Wizard. 
 Right click on the policy and "Apply to Site". Pick the Site mentioned in the step #2. Create new schedule. To run the task every hour set "Repeat Task every 1 hour, with duration 24 hours". 
 Enable schedule. 
 Pick the repository to collect to mentioned in the step #3. 
 Finish the wizard. 
 Commit all changes (right click on Quest InTrust Manager root node, Commit). 
 After the first successful gathering session open Repository Viewer and observe the repository you collect to. Create a custom Search with a layout containing fields you like.