[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 368
  • Last Modified:

Configure Event Viewer Changes

I have a couple of SBS 2003 and also a couple of SBS 2008 servers. When I see an event id of 529 which is "Unknown user name or bad password" I then want to know if a login was sucessful. Can I set this up to show in the event viewer or some other easy way? Also can I set a threshold so that I will only see a sucessful logon if there are more than x number of bad login attempts?
0
LostInWindows
Asked:
LostInWindows
  • 2
2 Solutions
 
Don S.Commented:
Yes and no.  You can change the audit policy to include successful login attempts.  However, you can not descriminate which successful attempts are included.  It's either ALL successful or NO successful (which is the default).  If you want to filter the logs better than Windows does natively, you would need to get a 3rd party log viewing program - of which there are many.
0
 
LostInWindowsAuthor Commented:
Can you please provide the names of some 3rd Party log programs that are worthwhile?
Thanks
0
 
jakosysadminCommented:
we, for instance use SawMill (http://www.sawmill.net/) which I can heartily recommend.

You can, of course, with a little PowerShell and ActivePERL magic accomplish all the required functionality with no need to shell out the dough ;)
0
 
LostInWindowsAuthor Commented:
Thanks for the help!
0

Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now