Re: display last login and unsuccessful login attempts


"alps" <alpeshic@xxxxxxxxx> wrote in message
news:1172247369.249692.110980@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Feb 18, 12:28 pm, "Steven L Umbach" <n...@n0-spam-for-me-
comcast.net> wrote:
That information is kept in the security log once auditing of account
logon
and /or logon events is enabled for success and failure in Local Security
Policy as explained in the first link below. There are third party
programs
that can help you create reports of the information you want such as GFI
Events Manager.

Steve

http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260 --- for
domain controllers you need to enable auditing in Domain Controller
Security
Policy or whatever GPO linked to the domain controller container that you
are using to manage domain controller policy if you have additional GPOs
linked to it.

http://kbase.gfi.com/showarticle.asp?id=KBID002879 --- GFI Events manager

http://www.microsoft.com/technet/security/guidance/auditingandmonitor...
-- The Security Monitoring and Attack Detection Planning Guide

"alps" <alpes...@xxxxxxxxx> wrote in message

news:1171655753.708408.179470@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx



I have a requirement. In which after successfullogininto the system
administrator will get the banner which gives LastLoginDate and
Time, Number ofunsuccessfulLoginattemptssince last successful
loginn and Location of worksation of lastlogin.

Thanks,
Alpesh- Hide quoted text -

- Show quoted text -

Thanks Steve for the information.

But, I am not using Active directory in Windows 2000 and when I tried
to use the Attributes BadPwdCount and LoginWorkstation It give me
error that Directory does not have properties in cache.
For the Last Login it shows the Lastlogin Time for the Current
Session.
I am looking for the Last login time of Previous Session.

So, Any more information will be highly appreciated.


Thanks,
Alps


So, I am really curious, outside of an AD environment, what
is the meaning of "Location of worksation of last login" ?
Is this in a Netware or Kerberos realm?
Else, are not all logins essentially local, at workstation
of the account's definition?

Else, it sounds like you would need to implement something
as LastLogin is not a linked list of prior logins, I mean, there
is LastLogin but not NextToLastLogin. So you would need
to devise that datakeeping. The other could be grepped from
the security log if you are recording failed login attempts
(next to last login may seem obtainable from security event
log also, except for some machine/application confurations
it can be deceptively difficult - ex. log into an IIS website
for authoring is recorded as a local login even though it is
all over http and done from other side of the world).

Roger


.

Relevant Pages

  • Software Package
    ... security but when I login I get nothing, I then restart the system and ... I then changed the policy to change the auditing to ...
    (microsoft.public.win2000.group_policy)
  • Fwd: Oh Dear, Where to start?!
    ... It seems to me you need two things: an organizational policy, ... finish college and break into the real world of computer security. ... experience in the field of network security and policy ... updates, driver updates, and recommended updates. ...
    (Security-Basics)
  • RE: [fw-wiz] PIX vs Checkpoint vs Sonicwall vs Netscreen - comme nts?
    ... All NetScreen appliances rely on custom-designed ASICs (Application ... Specific Integrated Circuits) for security policy enforcement. ... supports a finite number of "rules" or "policies". ...
    (Firewall-Wizards)
  • RE: Cant set Local Security policies. They fail to save
    ... predefined Security Template on SBS 2003 to restore security groups ... run "gpupdate.exe /force" under command prompt to force the policy ... reboot the Server to test. ... and then logon to client computer to test if user can save system logs. ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... Server Security and Auditing Policy ... This list only includes links in the domain of the GPO. ... The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.win2000.group_policy)