Generally the only way to tell would be to haul the account name from the event and run some WMI or srvinfo query against it to return the OS
2009/10/8 Rick Fogarty <rick.foga...@us.army.mil> > I think it's 645 Security. Now wondering if there is a way to distinguish > between workstations and servers. Guess not considering at that point of > the process there is no difference. > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > -- "On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question." http://raythestray.blogspot.com ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
