I have tested WMI method...
now WMI Connector indeed still collect all windows events from windws...but need modify setting...special AD mode...remember when set WMI Connector , you must set modified setting, if you use default setting and then modified later, you will see your modified will be auto reset about 10 mins....


wyldkao