Re: Auditing Workstation logons from DC

You may want to think about looking directly at the security logs of
the client systems, using such as EventCombMT
http://search.microsoft.com/results.aspx?mkt=en-US&setlang=en-US&q=eventcombmt

Alternatively if you are adventurous look into LogParser
http://www.logparser.com/

--
Roger

"Andy1974" <Andy1974@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:24118BA3-CED5-455C-986A-F78AA341B81A@xxxxxxxxxxxxxxxx
>I am trying to see workstation interactive logins in the Windows 2003 DC
> event viewer but am not seeing the events. I am seeing Remoteinteractive
> as
> well as interactive directly into the Domain Controller itself. However
> workstation computers that are a member of the domain are not registering
> event 528 or 539 type 2's in the event viewer. I have Domain Security
> Settings for Audit account logon to Success and Audit logon events to
> success. I have Domain Controller Settings to audit account logon to
> Success
> and Failure and Audit Logon to Success and Failure. I am running Windows
> 2003 Small Business Server.


.

Relevant Pages

  • Re: Auditing Workstation logons from DC
    ... logs you are at risk of reliability loss by local admin flushing of logs. ... >>> well as interactive directly into the Domain Controller itself. ... >>> Settings for Audit account logon to Success and Audit logon events to ... I have Domain Controller Settings to audit account logon to ...
    (microsoft.public.security)
  • Re: Audit interactive logins workstations on DC event viewer
    ... >I am trying to see workstation interactive logins in the Windows 2003 DC ... > well as interactive directly into the Domain Controller itself. ... > Settings for Audit account logon to Success and Audit logon events to ... I have Domain Controller Settings to audit account logon to ...
    (microsoft.public.windows.server.sbs)
  • Re: Event Viewer
    ... > It all depends on your security policy and needs for your situation. ... > minimum it is a good idea to enable in Domain Controller Security Policy - ... > for success and failure, logon events for failure, account management for ... > success and failure, and policy change for success and failure. ...
    (microsoft.public.win2000.security)
  • Re: Log-in log-out
    ... When you double click on "Audit account logon events" you will see the ... success and failure but even if I restart my PC (to ...
    (microsoft.public.win2000.general)
  • RE: Logging User Logon/Logoff
    ... I apologize it's the "audit account logon events" that needs to be enabled. ... Therefore you can uncheck the success and failure of the "audit logon ...
    (microsoft.public.windows.server.sbs)