Event ID's for DC authentications

Hi Guys

We are running Windows 2003 Domain Controllers in our environment.

On one of the DC's, I would like to get info on every person who has authenticated against it over 24 hours, and also the number of authentications.

I guess I can do this using Event ID's and Event Comb, but I'm not sure of which Event ID's to actually filter against?
LVL 3
kam_ukAsked:
Who is Participating?
 
Brian PierceConnect With a Mentor PhotographerCommented:
You need to enable the auditing of Account Logon in the security policy, the ID is 672
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.