SBS: "sbsmonacct" and healthmon alerts

For those of you that are old hats at the SBS support thing, you’ve probably long since ran across, and forgotten about the creation and deletion of the “sbsmonacct” account in the security log (filter for event ID 624 and/or 630; 4:30am-ish). I recall seeing this *way back* when I was first taking a look at SBS 2003. Having noticed it, I promptly filed it away for future reference.

Interestingly enough, I came across it again over the weekend after adding some monitoring alerts in healthmon to a customer’s installation on Friday. In checking my email on Saturday, I noticed that I had some account creation/deletion notices that had been fired off. Having since logged in to evaluate this, I was able to determine that this was expected behavior.

That, and… my alerts are firing nicely.