Thanks, Norm for your response. No, I was unable to get it to work.
All wanted is for check_mk to show a CRT message when event ID 4720 is triggered in the domain controller.
Powershell script to send email alert works.
That will be great if you could put together a simple script to do this job.
Thanks and much appreciated.
Dave