Deployed SAM to a W2012R2 Server and another Windows Machine yesterday,
connecting to Sentinel 7.3.1 Appliance.

Both Machines show up twice in ESM, once under "Microsoft Active
Directory and Windows" (updated the collector to 2011.1r6), and a second
time under "NetIQ Universal Event"

On top, most if not all current Events coming from these Servers
(standard windows event log stuff like services starting and stopping)
are shown in Sentinel as "Event source not in other category: NetIQ
Universal Event"


Massimo Rosen
Novell Knowledge Partner
No emails please!