Auditing logon and logoff isn't getting into Security log



Hello

I'm trying to setup logon auditing for a windows 2000 server, which is
the only server in the domain/AD. I followed Microsoft's KB
instructions for setting this up, however, when I test it by logging
off and on of a windows XP workstation that is a member of the domain,
nothing is getting written into the security log.

I am seeing the Security policy applied sucessfully in the Application
log, so I'm guessing the policy is getting updated with the auditing
information, but still nothing is showing up in the security log when I
log on and off.

The only thing I'm seeing as far as errors/warnings is a warning about
DNS getting invalid domain packets from one of the forwarders we use.

is there a delay between setting up the GPO & it's being implemented?

Any help, or even where to start looking, would be appreciated.

.



Relevant Pages

  • Re: Windows server 2003 Security Log
    ... > It seems like my Windows 2003 Server is logging way too many events in the ... > security log. ... MVP for Windows Server - Management ...
    (microsoft.public.windows.server.general)
  • RE: Logging on/off
    ... I have the same problem on my Windows Small Business Server 2003. ... last 14 days the security log is full with 172.000 records of successfull ... In the same IP-Subnet ist a Windows SBS 4.5. ...
    (microsoft.public.windows.server.general)
  • Re: Would a full event log file give me serious problems
    ... log on to a computer that is running Windows XP or Windows ... How To Prevent Auditable Activities When Security Log Is Full ... RPC "Server is Unavailable" Message When Audit Log is Full ... The event log stops logging events before reaching the maximum log size ...
    (microsoft.public.windowsxp.general)
  • Re: Windows login packets / events
    ... NT4 domain) and have a network capture over a period of time. ... Also is there an event in the security log which shows that a user has ... How about enabling audit of logon events on Windows 2000 Server itself? ...
    (microsoft.public.security)
  • Re: user cant access OWA or RWW
    ... I filtered the Security log on the server using her name in the User box and unchecked Success. ... Now I see Event 533's for her account when I tried it this morning. ... There should be a couple of events during this login process. ...
    (microsoft.public.windows.server.sbs)