troubleshooting Question

Not logging the workstation name

Avatar of Simon336697
Simon336697Flag for Australia asked on
Active Directory
5 Comments2 Solutions1324 ViewsLast Modified:
Hi guys hope you are all well and can assist.
We have an AD 2003 domain.

We have auditing enabled for the following events in the Default Domain Controllers Group Policy

Audit account logon events          Success, Failure
Audti account management          Success, Failure
Audit directory service access       Success
Audit logon events                       Success, Failure
Audit object access                       No auditing
Audit policy change                       Success
Audit privilege use                        No auditing
Audit process tracking                  No auditing
Audit system events                     Success

The following event shows you that the "Workstation Name" field is NOT capturing the name of the workstation. It is totally blank.
We want the name of the workstation to be captured, and Im not sure what to do to get this.

The following is seen on the DOMAIN CONTROLLER in its Security Log.

===================================================== Event Log > Security > Event ID 540

Event Type:      Success Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      540
Date:            11/08/2011
Time:            10:39:49 AM
User:            AN\kxbg
Computer:      AUYNPZ82
Description:
Successful Network Logon:
       User Name:      kxbg
       Domain:            AN
       Logon ID:            (0x0,0x2FDC891B)
       Logon Type:      3
       Logon Process:      Kerberos
       Authentication Package:      Kerberos
       Workstation Name:                                                                --------------------> This is the field we want to capture.
       Logon GUID:      {1a290428-65c6-7ceb-c001-4393c0db2dd5}
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID: -
       Transited Services: -
       Source Network Address:      10.170.0.204
       Source Port:      2697

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Any help greatly appreciated as to why the name of the workstation is not being captured.

Thanking everyone in advance.
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 2 Answers and 5 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 2 Answers and 5 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros