Re: Security log is blank?

From: Steven L Umbach (n9rou_at_nsattbi.com)
Date: 06/14/03


Date: Sat, 14 Jun 2003 01:55:00 GMT


        Check the local security policy on that workstation to make sure
that logging is enabled in the "effective setting". I believe that nothing
will be shown in the log on the local computer unless a user logs into the
"local machine" and not the domain, if only audit account logon events is
enabled. It should show on a domain controller though when a user attepmts
to log into the domain. Try enabling auditing for logon events also if you
have not done such and make sure success and failure are enabled. I assume
the ex employee has his account disabled. He may have been trying to log in
with an account other that he used to have. --- Steve

"Gregory" <gtreadway@healthyarkansas.com> wrote in message
news:008801c331d4$61146460$a501280a@phx.gbl...
> My security log is blank on one particulary Win2k Pro PC
> and everytime this PC logs in to our network, there is
> nothing in our security logs (local pc or the sever) to
> show this. What is going on? I have set on the local pc
> and the server to show all login attempts, but nothing is
> showing. The security logs on this pc have not been
> cleared, they are just blank. The other logs seem to be
> working fine (application and system). I caught someone
> who used to work here trying to login, but I have no
> security logs to prove it. Any ideas?



Relevant Pages

  • Re: How to know if someone accessed using RDP
    ... Was he logging in with a domain account? ... authentication from his user account. ... check the security logs on the server he was logging into. ...
    (microsoft.public.win2000.active_directory)
  • Admin lockout bug?
    ... I get failure logs from the Security logs ... "Account locked out". ... I read in some newsgroup post somewhere that it's a bug in win2k that will ...
    (microsoft.public.win2000.security)
  • Re: AD User Account Illusions
    ... We have the logs set at maximum which is 4,194,240k This ... >the available disk space allotted to your security logs ... >>I have an account that continually dissapears out of AD ...
    (microsoft.public.win2000.active_directory)
  • Re: unaccesible system event log
    ... Sophos EM Library is one part of antivirus solution for distributing ... I have no access to server now, so I can't answer exactly your questions ... about security logs ... And what do you see in the security logs (is auditing turned up so you get ...
    (microsoft.public.windows.server.active_directory)
  • Re: The security log on this system is full
    ... Even I clear the event security logs, the error disappears during some days ... I wouldn't set to ''1'' because it will crash my server. ...
    (microsoft.public.security)