Event ID's for DC authentications

Posted on 2009-05-07
Medium Priority
Last Modified: 2012-05-06
Hi Guys

We are running Windows 2003 Domain Controllers in our environment.

On one of the DC's, I would like to get info on every person who has authenticated against it over 24 hours, and also the number of authentications.

I guess I can do this using Event ID's and Event Comb, but I'm not sure of which Event ID's to actually filter against?
Question by:kam_uk
1 Comment
LVL 70

Accepted Solution

KCTS earned 2000 total points
ID: 24323466
You need to enable the auditing of Account Logon in the security policy, the ID is 672

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
If you need to implement application level security in an Access database application or other VBA code, I strongly encourage you to take advantage of Active Directory groups.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

619 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question