Authentication Auditing

From: Brad Baker (brad_at_nospam.nospam)
Date: 10/21/05 

Date: Fri, 21 Oct 2005 15:41:44 -0400

We are trying to ensure that we have auditing enabled for all login attempts
to either domain or local machine accounts.

I believe that we have enabled auditing for domain level accounts through
GPO. We have enabled "audit account logon events" and "audit logon events"
under Local Policies -> Audit Policy. I am seeing login attempts for domain
accounts on our domain controller's security logs but I am not seeing login
attempts for local accounts either in the domain controller's security logs
or on the local machine security logs.

How do we enable logging of authentication attempts against local (not
domain) accounts? Is this another GPO setting? Are we looking in the wrong
place? Alternatively, is there a setting at the local machine level that
needs to be set? Any information or assistance would be appreciated.

Thanks,
Brad Baker

Relevant Pages

  • RE: Local Accounts
    ... domain user accounts administrators on the local machine. ... This will give them admin rights on the local machine ... though I can do this for the Administrator account as well. ...
    (microsoft.public.windows.server.sbs)
  • Re: Domain workstation cannot see the domain for adding user permissio
    ... problem to a domain controller, or a problem with it's security account. ... other machines see the local machine (and all created accounts on ...
    (microsoft.public.windowsxp.security_admin)
  • Re: [opensuse] fstab: umount as user
    ... frequently dynamically created on the local machine on login and the ... Doesn't this qualify as dynamically created on the local machine? ... hundred workstations, several thousand user accounts, charged printer ... network administrators snmb, router, radius and firewall management can ...
    (SuSE)
  • RE: Local Accounts
    ... No server. ... Because the users still have local computer accounts, ... though I can do this for the Administrator account as well. ... the domain), on the local machine, and give them admin rights to the domain? ...
    (microsoft.public.windows.server.sbs)
  • Re: Repost: Local logon and Network Access settings
    ... think require network login since they are over the wire do in fact ... In the default situation, Authenticated Users ... is a member of User on a member machine, and, Users are granted ... user accounts that should be allowed to log into the machines in SomeOU. ...
    (microsoft.public.windows.group_policy)
Quantcast