Re: can I see failed attempts to log on to a restricted WS?

From: Matt Anderson (andersonnoapam_at_dynedge.com)
Date: 10/17/04 

Date: Sun, 17 Oct 2004 15:23:26 -0400

"mmac" <no@thank.you> wrote in message
news:%236ebhyHtEHA.2668@TK2MSFTNGP12.phx.gbl...
> Is there a log somewhere that would show me failed attempts to log onto a
> workstation that is restricted to small group of users via GPO? The people
> KNOW this machine is locked down and yet someone keeps trying. I need to
> find them and step on thier neck.
> Is there a logfile or some setting I can look at. I don't see them in the
> security log
>
There is security auditing that you can use. Open ADUC. Compter
configuratin -> Windows setting -> security settings -> local policies ->
audit policies. Depending on your situation you may consider just a local
policy instead of a domain wide policy.

Matt
MCT, MCSE

Relevant Pages

  • Re: Can you find when someone logs in?
    ... Check the security log. ... Set the "Audit account logon events" policy ... BTW, I have FULL Admin rights to this workstation, if that helps. ...
    (microsoft.public.windows.server.general)
  • Re: what gpo setting is this?
    ... English blog: http://lordoftheping.blogspot.com ... In the same place check for "Interactive Logon: ... For that policy you need to create a conflict policy that reverses ... Simple (Assuming that you moved that workstation ...
    (microsoft.public.windows.server.active_directory)
  • Re: a forensic question
    ... > findstring then do the same for any network drive access they have. ... > it the slave on a machine with Easy Recovery Pro installed. ... But she discovered that some important files on her workstation ... >> security log of the PDC? ...
    (comp.security.misc)
  • RE: group policy errors
    ... Thank you for posting to the SBS Newsgroup. ... I understand that you found error in Resultant Set of Policy on one client ... Does this issue happen on one domain client workstation or all of them? ...
    (microsoft.public.windows.server.sbs)
  • Re: Preventing logon to local accounts
    ... If you have group policy management console installed on your DC then you ... The firewall is disabled on the workstation. ... once connected, expand local users and groups, then select groups, open ... Domain Users in the listing of groups in this category. ...
    (microsoft.public.windows.server.active_directory)