This is a follow up post to my previous FCS definitions post.  The first one focused on the mpam-fe files and what is contained that you can find on the security portal at www.microsoft.com/security/portal .  This one instead focuses on what...

I already did one post about using eventcomb/logparser to look for clients but found a better way to do it on a case last night which I wanted to share.  The first thing you need is to enable netlogon debug logging on all of your DC’s save the following...