Hello:I setup a scheduled task to send me an email (on event) on server 2008 for event ID's: 4720, 4722, 4725, 4726, and 4740.My question is: Is there a way to put in more details in the email such as variables? I tried to put in %USERNAME%. so that (event id 4740) I know which users was locked out with out having to goto the server to check. Ideally, i would like the email to give me the following information: (this is also dependent on which event id is created) Event ID, User name that is effected.Please helpThanks,Miller-IT

Hello, I am afraid it is not possible to do that using the “Send an email” function in Task Scheduler in Windows Server 2008. Tim Quan - MSFT

Hi Tim:Ok, Thanks.Miller-IT

Miller-IT, I've got what you're asking for working... (sort of) it will send an email, but instead of useful variables in an email, it has an attachment (txt file) with the details of the lockout. using wevtutil.exe, you can parse out event id 4740 from your security log into a txt file... set your scheduled task to point to a batch file that includes the wevtutil.exe... and then have the same task send an email. (just make sure 'start a program' batch file runs before the 'send an email' task on the actions tab) I've included the contents of the batch file below... (the del command makes sure that txt file doesn't grow too large, by default the wevtutil.exe string below will append the file) del C:\lockout\MyLockout.txt wevtutil.exe /remote:DCServername qe Security /q:*[System[EventID=4740]] /f:text >> c:\lockout\MyLockout.txt -Phil