Windows service for login events

Experts,


    What is the windows service(s) that perform the login events?
    I am playing with a  Windows 2000 professional and it is not logging login attempts ( successful or unsuccessful). Could this be a registry problem?
    In the "Local Security Policy" setting, every "success " and "failure" is checked.


regards,
Nick
nicotine1Asked:
Who is Participating?
 
sirbountyConnect With a Mentor Commented:
There's two steps to enabling logging: http://support.microsoft.com/?id=300549
0
 
jkrConnect With a Mentor Commented:
The logons are handled by 'winlogon.exe'. From "Inside Windows 2000":

---------------------------------------------->8---------------------------------

Interactive logon (as opposed to network logon) occurs through the interaction of the logon process (Winlogon), Lsass, one or more authentication packages, and the SAM or Active Directory. Authentication packages are DLLs that perform authentication checks. Kerberos is the Windows 2000 authentication package for interactive logon to a domain, and MSV1_0 is the Windows 2000 authentication package for interactive logon to a local computer, for domain logons to trusted pre-Windows 2000 domains, and for when no domain controller is accessible.

[...]

Winlogon relies on a Graphical Identification and Authentication (GINA) DLL to obtain a user's account name and password. The default GINA is Msgina (\Winnt\System32\Msgina.dll). Msgina presents the standard Windows 2000 logon dialog box. Allowing for other GINAs to replace Msgina enables Windows 2000 to use different user identification mechanisms. For example, a third party might supply a GINA that uses a thumbprint recognition device to identify users and extract their passwords from an encrypted database.

Winlogon is the only process that intercepts logon requests from the keyboard. After obtaining a username and password from the GINA, Winlogon calls Lsass to authenticate the user attempting to log on. If the user is authenticated, the logon process activates a logon shell on behalf of that user. The interaction between the components involved in logon is illustrated in Figure 8-8.

In addition to supporting alternate GINAs, Winlogon can load additional network provider DLLs that need to perform secondary authentication. This capability allows multiple network providers to gather identification and authentication information all at one time during normal logon. A user logging on to a Windows 2000 system might simultaneously be authenticated on a UNIX server. That user would then be able to access resources of the UNIX server from the Windows 2000 machine without requiring additional authentication. Such a capability is known as one form of single sign-on.

---------------------------------------------->8---------------------------------

See also

http://www.microsoft.com/windows2000/techinfo/reskit/en-us/gp/518.asp ("Audit logon events")
http://msdn.microsoft.com/library/en-us/gp/518.asp ("Audit logon events (Windows 2000 Group Policy Reference)")
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.