Failure audit events not being logged

From: Renato Martins (renatoalmeidamartins_at_nospam.ibest.com.br)
Date: 06/30/04 

Date: Wed, 30 Jun 2004 15:46:42 -0300

Hi all,

does someone have an idea of what might be happening? I have a Windows
Server 2003, for testing purposes. It's the only domain controller
(actually, the only PC on my network). I've adjusted the "Default domain
policy", so that the Success and Failuer of Account Logon and Logon Events,
are audited (by going to "Computer configuration", "Security Settings",
"Local Policies", "Audit policy").

After having set this up, I try to logon with a valid user, entering the
wrong password several times (for example, until account lockout). After
that, logging as administrator, and analyzing the security log, in event
viewer, I see no "Failure Audit" events. Only the "Success Audit" events...

Is there a bug related to the logging of failed logon attempts??? Any clues
on this?

Thanks in advance.
Renato

Relevant Pages

  • Re: RDP/TS GPO Settings - Users unable to logon
    ... Most likely the helpdesk guys are logging on to a domain controller. ... Logging in to a domain controller is restricted to Admins and Backup ... Others will be denied because they are not allowed to logon locally ...
    (microsoft.public.windows.server.active_directory)
  • Failure audits not being logged
    ... policy", so that the Success and Failuer of Account Logon and Logon Events, ... are audited (by going to "Computer configuration", "Security Settings", ... "Local Policies", "Audit policy"). ... Is there a bug related to the logging of failed logon attempts??? ...
    (microsoft.public.win2000.security)
  • Re: Domain Controller Not logging Security Audit Settings
    ... > My W2kAS domain controller is not logging the security audit as set in the ... > Local Audit settings are correct but Effective settings remain flagged as ... all Group members have accepted and are logging the Audit ... > as set in in the Group Policy on the Domain Controller. ...
    (microsoft.public.win2000.security)
  • AD - Win98 Client Logon Failure
    ... domain controller, our 100 Win98 clients started having ... While logging in, the Win98 clients are displaying the ... or access to your logon service has been denied". ...
    (microsoft.public.win2000.active_directory)
  • Re: Benutzerkonten oft gesperrt !!!
    ... Wie heißt auf deutsch "account logon events" und "logon events"? ... Configuring Audit Policy ... you don't use User Manager to enable auditing in Win2K. ...
    (microsoft.public.de.german.win2000.active_directory)