Re: Event viewer Login and logoff

From: frank (fjlopez_at_nospam.com)
Date: 11/23/04 

Date: Tue, 23 Nov 2004 13:08:15 -0500

yeah domain logins... it doesn't have the computer name listed they logged
in from login aduit is enabled.success and failures. Under security event
540 it has the time stamp and the ip address but not the computer the user
logged in from. i know i can llok at my dhcp and see what ip address was
assigned but why isn't the workstation name there.

"Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
news:er$9d0N0EHA.424@TK2MSFTNGP14.phx.gbl...
> If you are talking domain logons then you also want to enable account
> logon events in Domain Controller Security Policy. If you mean type three
> network logons to a computer for share access, etc check all the logon
> events as there probably will be more than one grouped by the same or
> nearly same timestamp [within a few seconds]. --- Steve
>
>
> "frank" <fjlopez@hotmail.com> wrote in message
> news:uXhS0TlzEHA.748@TK2MSFTNGP14.phx.gbl...
>>I have been auditing login and log off events and it doesn't log the
>>compter name in the events. how can i get this to happen.
>>
>
>

Relevant Pages

  • Re: Network Logins
    ... >is trying to login as them with a bad password. ... You could activate security auditing, ... logons. ... Hans-Georg ...
    (microsoft.public.windowsxp.network_web)
  • Event ID 534: logon failure
    ... one of the users loses the ability to login becuase the security event ... "user has not been granted the requested logon type at ...
    (microsoft.public.windows.server.sbs)
  • Re: Hacking attempts?
    ... How are you determining that these are RWW login attempts? ... actual security event being logged? ... It did not appear that any were successful. ...
    (microsoft.public.windows.server.sbs)