?
Solved

Windows service for login events

Posted on 2004-09-23
2
Medium Priority
?
621 Views
Last Modified: 2011-09-20
Experts,


    What is the windows service(s) that perform the login events?
    I am playing with a  Windows 2000 professional and it is not logging login attempts ( successful or unsuccessful). Could this be a registry problem?
    In the "Local Security Policy" setting, every "success " and "failure" is checked.


regards,
Nick
0
Comment
Question by:nicotine1
2 Comments
 
LVL 67

Accepted Solution

by:
sirbounty earned 900 total points
ID: 12133952
There's two steps to enabling logging: http://support.microsoft.com/?id=300549
0
 
LVL 86

Assisted Solution

by:jkr
jkr earned 600 total points
ID: 12133994
The logons are handled by 'winlogon.exe'. From "Inside Windows 2000":

---------------------------------------------->8---------------------------------

Interactive logon (as opposed to network logon) occurs through the interaction of the logon process (Winlogon), Lsass, one or more authentication packages, and the SAM or Active Directory. Authentication packages are DLLs that perform authentication checks. Kerberos is the Windows 2000 authentication package for interactive logon to a domain, and MSV1_0 is the Windows 2000 authentication package for interactive logon to a local computer, for domain logons to trusted pre-Windows 2000 domains, and for when no domain controller is accessible.

[...]

Winlogon relies on a Graphical Identification and Authentication (GINA) DLL to obtain a user's account name and password. The default GINA is Msgina (\Winnt\System32\Msgina.dll). Msgina presents the standard Windows 2000 logon dialog box. Allowing for other GINAs to replace Msgina enables Windows 2000 to use different user identification mechanisms. For example, a third party might supply a GINA that uses a thumbprint recognition device to identify users and extract their passwords from an encrypted database.

Winlogon is the only process that intercepts logon requests from the keyboard. After obtaining a username and password from the GINA, Winlogon calls Lsass to authenticate the user attempting to log on. If the user is authenticated, the logon process activates a logon shell on behalf of that user. The interaction between the components involved in logon is illustrated in Figure 8-8.

In addition to supporting alternate GINAs, Winlogon can load additional network provider DLLs that need to perform secondary authentication. This capability allows multiple network providers to gather identification and authentication information all at one time during normal logon. A user logging on to a Windows 2000 system might simultaneously be authenticated on a UNIX server. That user would then be able to access resources of the UNIX server from the Windows 2000 machine without requiring additional authentication. Such a capability is known as one form of single sign-on.

---------------------------------------------->8---------------------------------

See also

http://www.microsoft.com/windows2000/techinfo/reskit/en-us/gp/518.asp ("Audit logon events")
http://msdn.microsoft.com/library/en-us/gp/518.asp ("Audit logon events (Windows 2000 Group Policy Reference)")
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This shares a stored procedure to retrieve permissions for a given user on the current database or across all databases on a server.
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…
Suggested Courses
Course of the Month16 days, 22 hours left to enroll

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question