Re: Audit Logon Failures

From: Carolyn (Carolyn_at_discussions.microsoft.com)
Date: 04/23/05 

Date: Fri, 22 Apr 2005 17:29:53 -0700

Thank you very much, I will try this.

-- Carolyn

"Steven L Umbach" wrote:

> For a domain you want to enable auditing of "account logon" events for
> success and failure in Domain Controller Security Policy. Then you have to
> look in the security logs of all the domain controllers for the events you
> want to track. You can use Event Comb [free from MS] to make it a lot easier
> to do centralized. Try doing a few test failed logons for a domain user to
> see if the failure events are recorded. If you want to record logon failures
> to the "local" accounts on a domain computer you will need to enable
> auditing of logon events for the domain computers. Be sure to increase the
> size of your security log quite a bit from default to at least 10MB. The
> link below may help. --- Steve
>
> http://www.microsoft.com/technet/security/prodtech/windows2000/secmod144.mspx
>
> "Carolyn" <Carolyn@discussions.microsoft.com> wrote in message
> news:D5E8F86A-E8F9-47F2-8592-AD319439C96C@microsoft.com...
> >I am trying to audit logon successes and failures for my Windows 2003
> >domain.
> > At the domain controller, the Security log is set to audit logon successes
> > and failures, but only logon successes show up in the log.
> >
> > -- Carolyn
>
>
>

Relevant Pages

  • ASP not working
    ... I host a site that runs classic ASP, but the site refuses ... to run and when I check the security log it some up with ... Category: Account Logon and Logon/Logoff ... Logon Failure: ...
    (microsoft.public.inetserver.iis.security)
  • Re: security event logs in DC as well ? SOS
    ... I don't know how you are seeing duplicate events because what is recorded in ... computer/user attempts to access the computer either via interactive logon ... event recorded on a domain controller at the sane time as you see a logon ... security log of a domain controller as account logon attempts. ...
    (microsoft.public.windows.server.security)
  • Kerberos Errors in the Audit Log.
    ... Event Source: Security ... Event Category: Account Logon ... Computer: (Domain Controller) ... Event Type: Failure Audit ...
    (microsoft.public.win2000.security)
  • Re: Login Time out
    ... If the users logon to just the domain and not the local computer, ... security log will have a LOT of events in it so you may want o use the ... domain controller, do it Domain Security Policy in administative tools on ...
    (microsoft.public.win2000.security)
  • Re: Security warning...
    ... > security log on one machine in a peer-to-peer Windows 2000 network. ... > Event Type: Failure Audit ... > Logon Failure: ...
    (microsoft.public.win2000.security)
Quantcast