Re: Auditing Account Logons

From: Will Wally (nomail_at_nomail.net)
Date: 02/21/05 

Date: Mon, 21 Feb 2005 08:23:36 -0500

I'm seeing it in the security logs when logged directly on to the DC via
remote desktop from a workstation. There is one domain in a single forest.

Will

"Roger Abell" <mvpNOSpam@asu.edu> wrote in message
news:e$0iZu0FFHA.1396@tk2msftngp13.phx.gbl...
> Are you seeing this when viewing the security logs while logged
> into a domain controller, or a workstation?
> How many domains are involved here? All in one forest ?
>
> --
> Roger Abell
> Microsoft MVP (Windows Security)
> MCSE (W2k3,W2k,Nt4) MCDBA
> "Will Wally" <nomail@nomail.net> wrote in message
> news:uvmnv1sFFHA.936@TK2MSFTNGP12.phx.gbl...
>> I need to audit when a user logs on to the domain from a workstation. In
> the
>> Domain Controller policy, I enabled "Audit Account Logon Events
>> (success/failure)" and "Audit Logon Events (success/failure)" under
> Conputer
>> Configuration > Windows Settings > Security Settings > Local Policies >
>> Audit Policy. It seems to be working, but the security logs don't show
> what
>> workstation they are logging in from. They show a Workstation GUID, but
>> no
>> workstation name. How do I get it to show which workstations the users
>> are
>> logging in from?
>>
>>
>
>

Relevant Pages

  • Re: Cannot browse to a domain controller across windows domains
    ... There are no security audit entrys success ... > or failure in the security logs when I try to log on...as though the ... > workstation which I am trying to browse the DC with has never contacted ... > to the domain controller of the outside domain. ...
    (microsoft.public.windows.server.networking)
  • Re: Why are my workstations changing their passwords?
    ... I'm seeing a burst of about 40 of the same messages for a single workstation ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ... that I've spent a lot of time analyzing the security logs, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Auditing Account Logons
    ... Are you seeing this when viewing the security logs while logged ... > I need to audit when a user logs on to the domain from a workstation. ... > Domain Controller policy, I enabled "Audit Account Logon Events ...
    (microsoft.public.windows.server.security)
  • pls help
    ... I have since yesterday had so many events in my security logs for users and workstatiosn which are not even in my LAN ... The logon to account: ibm ... from workstation: ASYLUM ...
    (microsoft.public.win2000.security)
  • Audit Logons
    ... I want to audit account logons for my DC, ... is logged whenever a user logs on to the domain from any ... workstation. ... switched on, such as event 673's and 538's, as I'm logging ...
    (microsoft.public.win2000.security)