| Author |
Message |
Will Wally
Guest
|
 Posted:
Sun Feb 20, 2005 3:51 am Post subject:
Auditing Account Logons |
|
|
I need to audit when a user logs on to the domain from a workstation. In the
Domain Controller policy, I enabled "Audit Account Logon Events
(success/failure)" and "Audit Logon Events (success/failure)" under Conputer
Configuration > Windows Settings > Security Settings > Local Policies >
Audit Policy. It seems to be working, but the security logs don't show what
workstation they are logging in from. They show a Workstation GUID, but no
workstation name. How do I get it to show which workstations the users are
logging in from? |
|
| Back to top |
|
 |
Roger Abell
Guest
|
| Posted:
Sun Feb 20, 2005 6:59 pm Post subject:
Re: Auditing Account Logons |
|
|
Are you seeing this when viewing the security logs while logged
into a domain controller, or a workstation?
How many domains are involved here? All in one forest ?
--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Will Wally" <nomail@nomail.net> wrote in message
news:uvmnv1sFFHA.936@TK2MSFTNGP12.phx.gbl...
| Quote: | I need to audit when a user logs on to the domain from a workstation. In
the
Domain Controller policy, I enabled "Audit Account Logon Events
(success/failure)" and "Audit Logon Events (success/failure)" under
Conputer
Configuration > Windows Settings > Security Settings > Local Policies
Audit Policy. It seems to be working, but the security logs don't show
what
workstation they are logging in from. They show a Workstation GUID, but no
workstation name. How do I get it to show which workstations the users are
logging in from?
|
|
|
| Back to top |
|
|
Will Wally
Guest
|
| Posted:
Mon Feb 21, 2005 7:23 pm Post subject:
Re: Auditing Account Logons |
|
|
I'm seeing it in the security logs when logged directly on to the DC via
remote desktop from a workstation. There is one domain in a single forest.
Will
"Roger Abell" <mvpNOSpam@asu.edu> wrote in message
news:e$0iZu0FFHA.1396@tk2msftngp13.phx.gbl...
| Quote: | Are you seeing this when viewing the security logs while logged
into a domain controller, or a workstation?
How many domains are involved here? All in one forest ?
--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Will Wally" <nomail@nomail.net> wrote in message
news:uvmnv1sFFHA.936@TK2MSFTNGP12.phx.gbl...
I need to audit when a user logs on to the domain from a workstation. In
the
Domain Controller policy, I enabled "Audit Account Logon Events
(success/failure)" and "Audit Logon Events (success/failure)" under
Conputer
Configuration > Windows Settings > Security Settings > Local Policies
Audit Policy. It seems to be working, but the security logs don't show
what
workstation they are logging in from. They show a Workstation GUID, but
no
workstation name. How do I get it to show which workstations the users
are
logging in from?
|
|
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in