Auditing Windows 2000 DC Help?

From: Stiltripin (Stiltripin_at_discussions.microsoft.com)
Date: 06/15/05

  • Next message: Dan: "Interesting File permission issue" 
    Date: Wed, 15 Jun 2005 13:32:03 -0700

    I have 3 DC's running Windows 2000 Server SP4. I have been tasked with
    auditing who logs on/off the network. I configured the Default Domain
    Controllers Policy to log Successful Account Logon events and Logon events.
    When I look at the logs, all that I see is computer accounts, system
    accounts and a very few user accounts with event id's 538, 540.
    Do I have this setup correctly? It seems to me I should be able to see every
    time a user logs on in the morning and logs off in the afternoon but that is
    not happening. Shouldn't I also be seeing event id 528 for a successful logon?

    Any guidance on this would be much appreciated...

  • Next message: Dan: "Interesting File permission issue"

    Relevant Pages

    • Re: Account Lockout Policies
      ... Deleting user accounts after 30 days of inactivity allows a windows of opportunity of 30 days for an ex-user to re-use the network. ... If a technical solution is unavoidable due to a lack of management buy-in, there are a few ways that it can be achieved. ... Ascertain from those logs when users last logged in and add 30 days. ... From the users logon script, touch a unique file in a common area. ...
      (microsoft.public.security)
    • Re: How do I abort a logon script
      ... Unfortunately all my accounts ... >> that I try to login into immediate logs me back out. ... >> there a way to abort a login script. ... >> clean up and reboot but once I rebooted I could not log ...
      (microsoft.public.win2000.security)
    • Re: Do not have permission to send to recipient....
      ... ever try enabling diagnostic logging for msexchangetransport? ... Topics for Exchange Server 2003 Diagnostic Logs ... email accounts and internal accounts. ... logs and there are no errors relating to this problem. ...
      (microsoft.public.exchange.admin)
    • Re: 2000/XP Networking Problem
      ... PASSWORDS are what need to match up between the two computers. ... >> you've checked event logs to see if there are any clues there. ... user accounts I did say "On the W2000 machine Network Identification ...
      (microsoft.public.win2000.networking)
    • Re: cannot receive email for multiple accounts
      ... instance in which the server said that it had any messages. ... So if these logs ... That is strange indeed because I sent multiple emails to the other accounts ... > credentials of the logged-in user first, ...
      (microsoft.public.outlook.general)
    • Quantcast