Auditing

From: Bryce Shaw (bryce@silicon-wafers.com)
Date: 08/29/02 

From: "Bryce Shaw" <bryce@silicon-wafers.com>
Date: Thu, 29 Aug 2002 12:05:44 -0400

Hi Everyone,

It seems I'm having a problem setting up auditing. I had previously set up
account lockout after 3 bad hits....you know....to help keep the bad guys
out. And two people on my network keep having their accounts tripped. So I
tried to set up Logon/Off auditing. I open the MMC for Domain Security
Policy and expanded "Local Policies" and expanded "Audit Policy" and then I
set Audit account logon events to Success, Failure.

And from what I know, I thought that was all I had to do, but my security
log is still empty. Am I missing a step or something?

Thanx for any help,
Bryce Shaw

Relevant Pages

  • Re: Urgent: All AD users are locked out
    ... the auditing is turned on and all ws are for the inside. ... Now I did an workaround by changing the account lockout threshold to 0 to ... "Jorge Silva" wrote: ... MCSE, MVP Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account Lockout
    ... Enable auditing and look for lockout ... From the lockout events, determine which clients they originate from. ... >>> Do this via a GPO and watch for failed logon attempts. ... I have a user's account that is getting ...
    (microsoft.public.win2000.active_directory)
  • Re: Account Lockout
    ... Enable auditing and look for lockout events. ... >> Do this via a GPO and watch for failed logon attempts. ... I have a user's account that is getting ...
    (microsoft.public.win2000.active_directory)
  • Re: FSO to non domain server UNC?
    ... as long as there is an IUSR or IWAM account in both domains [or ... There should definitely be auditing events. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Account disapears
    ... This KB explains how to turn on Active Directory auditing in Windows Server ... on the auditing policies for Windows Server 2003 we find the Account ... success events to detect the deletion in Windows 2000. ...
    (microsoft.public.win2000.active_directory)