Auditing

From: Andre' (andre_muscat@hotmail.com)
Date: 12/17/02 

From: "Andre'" <andre_muscat@hotmail.com>
Date: Tue, 17 Dec 2002 03:38:56 -0800

In windows, once you enable
(1) Audit Logon events - success and failure
(2) Audit aco*** logon events - success and failure

There is no other account which you need to set up.

The events are logged inside the windows security event
log on each machine.

Tip : To manage the event log via the MS event viewer only
is very cumbersome especially if you have many machines to
monitor. I recommend you use a product which will
automatically scan the security event logs of all
computers and collect them in a central repository. Like
that you will only have one central location to monitor
all of your network. One such tool is GFI LANguard
S.E.L.M. (www.gfi.com).

Cheers,

Andre

>-----Original Message-----
>Another Quick Question
>
>I want to audit unsuccesful logon attempts..
>
>I have in the AD enable the Auditing to take plae of all
logon failures...
>
>now how do i set the user account to audit these
failures.. ?
>
>thanks
>.
>