Re: Auditing Workstation logons from DC

you will see the logons on each of the workstations. This is "Logon event"
that is logged locally on the computer, where the event occures. The domain
have no information about what type of logon occured, DC only provide the
user with general kerberos ticket or authenticate him by means of NTLM.


O.


<harlanandrew28@xxxxxxxxxxx> wrote in message
news:OS5glZUIGHA.2300@xxxxxxxxxxxxxxxxxxxxxxx
> I am trying to see workstation interactive logins in the Windows 2003 DC
> event viewer but am not seeing the events. I am seeing Remoteinteractive
> as
> well as interactive directly into the Domain Controller itself. However
> workstation computers that are a member of the domain are not registering
> event 528 or 539 type 2's in the event viewer. I have Domain Security
> Settings for Audit account logon to Success and Audit logon events to
> success. I have Domain Controller Settings to audit account logon to
> Success
> and Failure and Audit Logon to Success and Failure. I am running Windows
> 2003 Small Business Server.
>


.

Relevant Pages

  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Users cannot access remote web workplace without admin access
    ... RWW site logon issue ... When we create the user accounts by using the SBS add users ... workstation through the RWW-RDP connection? ... For the RDP access issue, it could be an expected behavior. ...
    (microsoft.public.windows.server.sbs)
  • Re: Active Directory Logon to attribute
    ... have permission to access as you are denied to logon from this workstation... ... If accounts and machines are from abc.com they can logon to abc.com only. ... named xyz.org for the user authentication for internet. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Event ID 539 & 529 in large numbers - from what?
    ... When I get an account locking out without obvious cause, I just go in and delete all the saved passwords. ... Both the username and the workstation name are legitimate user/workstation on the network. ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)