Solved

DC not showing failed logon attempts

Posted on 2014-12-15
2
179 Views
Last Modified: 2014-12-16
I have a domain controller that is 2008 R2 and I can't seem to get it to show the failed login attempts in the eventviewer.  Any suggestions on what I might be missing.   It shows the successful ones ......


Thanks .
0
Comment
Question by:jtbrown1111
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 6

Accepted Solution

by:
oferam earned 500 total points
ID: 40501362
Through the "Group Policy Management" you should edit the "Default Domain Controllers Policy" to include failed logon events.

Right click that policy - Choose edit... and navigate to:
Policies --> Windows settings --> Security Settings --> Local Policies --> Audit Policy

The are two relevant definitions overs there:
1) audit account logon events
2) audit logon events

Make sure those include failed as well.
0
 

Author Closing Comment

by:jtbrown1111
ID: 40503776
Thanks ....  This worked
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

718 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question