Re: Monitoring Security

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: ptwilliams (ptw2001_at_hotmail.com)
Date: 10/09/04 

Date: Sat, 9 Oct 2004 11:17:02 +0100

Enable auditing of Account logon events for the domain and see where the
logon failure failure audit is coming from.

\Computer Configuration\ Windows Settings\ Security Settings\ Local
Policies\ Audit Policies\ Audit account logon events 

-- 
Paul Williams
http://www.msresource.net
http://forums.msresource.net
______________________________________
"Juan" <Juan@discussions.microsoft.com> wrote in message 
news:FE63F7FB-9672-4AA4-8641-B1CEA1148E25@microsoft.com...
Hi,
a user of our Active Directory is automatically logged out after a short
time without using bad logon credentials.
Is it possble to monitor from which workstation the authentication requests
are coming? Or why the user is logged out? Perhaps someone is trying a
broute-force?
Thanks in advanced
Juan

Relevant Pages

  • Re: Track abnormal restart
    ... Set both Audit account logon events & Audit logon events for Success & ...
    (microsoft.public.windowsxp.general)
  • Re: how to track users session in XP
    ... If XP Pro, Group Policy. ... Set both Audit account logon events & Audit logon events for Success & ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Can you find when someone logs in?
    ... Windows only tracks your logins if you specifically configure it to "Audit ... Set the "Audit account logon events" policy ... BTW, I have FULL Admin rights to this workstation, if that helps. ...
    (microsoft.public.windows.server.general)
  • Re: Logon/Logoff Auditing
    ... Audit policy on domain controllers is controlled by the Domain Controllers ... Security Policy, ... I've enabled Audit Account Logon Events and Audit Logon Events ...
    (microsoft.public.win2000.security)
  • Re: Security logs not updating
    ... I have an issue where there are no entries in the security ... Have you enabled auditing of account logon events in your Local ... Administrative Tools -> Local Security Policy ...
    (microsoft.public.windowsxp.security_admin)