Why security log doesn't log Unsuccessful Logon attempts

Posted on 2007-10-18
Last Modified: 2013-11-08

Why security log doesn't log Unsuccessful Logon attempts? I have W2k3 I cleared the log to flush some settings and just tried to logon with wrong password and nothing was written to the log

Thank you

Question by:piotrmikula108
    LVL 2

    Expert Comment

    in the properties of your security log do you have failures selected?
    LVL 2

    Expert Comment

    more specifically failure audit?
    LVL 1

    Author Comment

    yes, I have all options selected, I just restored to default settings just in case, but I get the same behavior when I logon to other servers, they don't record unsuccessful login attempts. Hmmm, am I not understanding something here?
    LVL 24

    Expert Comment

    So you are sure you've gone into your security policy (not security log) to "Audit logon events" in Security Settings|Local Policies|Audit Policies and set to audit logon failures?
    LVL 5

    Accepted Solution

    If you want to record failures for logon events on other pcs as well you will have to edit each local group policy, unless you are working within a domain. Edit the current GPO policy on the OU that contains the servers and change the audit setting similar to Kenneniah's suggestion.

    If locally: start-run  gpedit.msc  Computer Configuration/Windows Settings/Security Settings/Local Policies/Audit Policy

    If via GPO: Computer Configuration/Windows Settings/Security Settings/Local Policies/Audit Policy

    You will have the option to audit many different items.

    In the Event Viewer you're just filtering.. however without auditing enabed your results will always be blank!


    Featured Post

    Live: Real-Time Solutions, Start Here

    Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

    Join & Write a Comment

    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    A while back when OPSMGR 2012 was released we were very excited about getting it into our environment and upgrading our 2007 implementation,  we started our planning and we then proceeded with our implementation. All went as planned & our system …
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    This video discusses moving either the default database or any database to a new volume.

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now