http://blogs.technet.com/b/askds/archive/2011/08/29/the-security-log-haystack-event-forwarding-and-you.aspxHi. This is your guest writer Mark Renoden . I&rsquo;m a Senior Premier Field Engineer based in Sydney, Australia and I&rsquo;m going to talk to you about the use of Event Forwarding to collect security events. This is particularly useful when: en-USTelligent Evolution Platform Developer Build (Build: 5.6.50428.7875)http://blogs.technet.com/b/askds/archive/2011/08/29/the-security-log-haystack-event-forwarding-and-you.aspx#3449760Mon, 29 Aug 2011 16:16:02 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3449760sgrinker<p>Awesome post... Event Forwarding is your friend!</p> <p>For anyone interested, you can couple Event Forwarding with PowerShell to essentially get a &quot;poor mans&quot; auditing utility. &nbsp;Basically forwarding then parsing data from Security log audit events into SQL for alerting and reporting.</p> <p>Definitely not looking to self promote, but thought I&#39;d share if anyone can find it useful. &nbsp;I know it has definitely come in very handy around here, so hopefully someone else can find some use of the work.</p> <p>Please don&#39;t use the comments here for any troubleshooting or assistance if you decide to use the module. &nbsp;Anything additional regarding the utility should be posted at the CodePlex link...</p> <p><a rel="nofollow" target="_new" href="http://pseventlogwatcher.codeplex.com/documentation">pseventlogwatcher.codeplex.com/documentation</a></p> <p>Thanks!</p> <p>Steve</p> <div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3449760" width="1" height="1">http://blogs.technet.com/b/askds/archive/2011/08/29/the-security-log-haystack-event-forwarding-and-you.aspx#3449754Mon, 29 Aug 2011 15:56:53 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3449754aemiller<p>I had done this about a year ago with my 2003 DCs. It was a pain. I am very happy to see this published and all in one place.</p> <p>Allan &quot;You better get busy then&quot; Miller</p> <div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3449754" width="1" height="1">