RE: Audit logon events

Check out the System Controls MP from Manakoa. It provides auditing for
Account Management activity and will centralize the data into System Center
reporting from all your DCs.

http://www.manakoa.com/products/scmp/

"Tony Marziano" wrote:

> There are many tools to centralise event log data on the web.
> If you want to centralise the ability to view event logs from different
> domain(s) and/or DC's, then you can start with Eventcombmt.exe from the
> windows 2003 RK Tools.
>
> "KIWI" wrote:
>
> > Hi
> >
> > I'm wanting to implement auditing for logon events to try and track
> > unauthorised activity and attempts to logon to the domain.
> >
> > I have a multi-site single AD Domain with 2 or 3 DCs at each site. If I
> > enable auditing for Logon events do I need to check the logs on all DCs.
> >
> > Is there a way that I can collate all the information from all DCs into 1
> > location or log?
> >
> > TIA
> > KIWI
> >
> >
> >
.

Relevant Pages

  • Re: Security logging stopped
    ... > Try using the Event Log viewer to clear the event log. ... > login successes and failure events was turned on in the RAS server ... > enable auditing on your RAS server: ... > Note that to enable logging of access to files or registry settings, ...
    (microsoft.public.security)
  • Re: possible security worry
    ... Turn on auditing as Austing suggested, ... The reason for it not appearing in the event log could not possibly be ... expiration settings changing and no record of that occurring in the event ... I can see other normal group adds and ...
    (microsoft.public.windows.server.active_directory)
  • Re: Can you Audit logouts??
    ... > I have auditing for logins/logouts turned on. ... > when people are logging in and logging out? ... > see when user John Doe logged out last week one night if ... The event log is painful to go ...
    (microsoft.public.win2000.security)
  • Re: Help with Security Audits
    ... Check out the new System Controls MP from Manakoa. ... It provides auditing ... When you say profile I don't ... >> I have auditing setup on this server for successful and unsuccessful logon ...
    (microsoft.public.win2000.security)
  • Re: possible security worry
    ... Turn on auditing as Austing suggested, ... eachother PW can lead to situations like this one, ... The reason for it not appearing in the event log could not possibly be ... expiration settings changing and no record of that occurring in the event ...
    (microsoft.public.windows.server.active_directory)