Re: Audit Account Log Events

From: Joe (Joe_at_discussions.microsoft.com)
Date: 11/30/04 

Date: Tue, 30 Nov 2004 05:49:01 -0800

Hi Steven.

I tought the security log events are recorded on each event viewer's member
server (not Domain Controller). That's what i'm expecting to.

"Steven L Umbach" wrote:

> For domain users, you need to enable auditing of account logon events in
> Domain Controller Security Policy and you will see the account logon events
> for domain users recorded in the security log of the domain controller that
> authenticated the user. --- Steve
>
>
> "Joe" <Joe@discussions.microsoft.com> wrote in message
> news:7667F80D-C1A7-483C-89CC-C18070D76B5C@microsoft.com...
> > Hi.
> >
> > Need help with a GPO. I'm trying to deploy a Domain Based Policy that
> > tracks
> > account log on events, but i'm having problems.
> >
> > I created an OU and "drop" the PCs i need to catch the POlicy to that OU.
> > I
> > created the Policy and linked to the OU, but nothing happen. Any ideas?
> >
> > PS: if i setup the policy on each PCs, i mean, locally, it works, but i
> > need
> > to deploy the policies at Domain level.
> >
> > Thanks in advanced,
>
>
>

Relevant Pages

  • Re: account lockout fails
    ... In my domain controller security log I received the following events ... Address is the workstation IP address. ... each other in the security log until there were a total of 24. ... domain lockout policy did not take effect and lock the account. ...
    (microsoft.public.win2000.security)
  • Re: security event logs in DC as well ? SOS
    ... I don't know how you are seeing duplicate events because what is recorded in ... computer/user attempts to access the computer either via interactive logon ... event recorded on a domain controller at the sane time as you see a logon ... security log of a domain controller as account logon attempts. ...
    (microsoft.public.windows.server.security)
  • SeSecurityPrivilege failure
    ... When I run a notification query in the root\cimv2 namespace using Wbemtest ... In the security log I see two ... The machine on which I am running this query is the only domain controller ...
    (microsoft.public.win2000.advanced_server)
  • WMI: Access Denied. SeSecurityPrivilege failure.
    ... When I run a notification query in the root\cimv2 namespace using Wbemtest ... In the security log I see two ... The machine on which I am running this query is the only domain controller ...
    (microsoft.public.win2000.security)
  • Re: Audit Logon Failures
    ... > success and failure in Domain Controller Security Policy. ... > auditing of logon events for the domain computers. ... > size of your security log quite a bit from default to at least 10MB. ...
    (microsoft.public.security)