Auditing in group policy problem

[wardog25]

In my default domain policy, I set up auditing for both account management events and for logon events.

Account management events now show up in the security log, but I have yet to see a logon event. (has been weeks)

Setting auditing account logon events for failure should give me something when people type in the wrong password, correct? I've had people get their account locked out by typing it wrong over 5 times, but still have not seen any account logon events in the security log.

What's the deal?

 

[GrnEyedLdy]

Hi Wardog25,

Are you auditing ACCOUNT LOGON EVENTS or LOGON EVENTS?


Quote from ComputerPerformance.com

"Watch out for two similar and potentially confusing policies, 'Audit Account Logon events' and 'Audit Logon events'. The difference is that Audit Logon events (the shorter one) means that you are checking who is pressing Ctrl Alt, Del at the domain controller (or desktop); whereas the Audit Account Logon events (the longer one) generates an event every time a user connects to that server across the network".

Just a thought...

Patty

 

[wardog25]

Hmm, I didn't understand the difference between those two. But I'd actually turned them both on, just in case I had the wrong one. But even with both on, i don't get any logon events listed.

Thanks

 

[GrnEyedLdy]

Default Domain Controllers Policy has a predefined audit policy that explicitly disables auditing.

If this policy is being read last, it is overriding the settings in your Default Domain Policy.

You can either enable auditing for this category in Default Domain Controllers Policy or switch the policy to not defined.

Patty

 

[GrnEyedLdy]

Hi Wardog25,

Did you get your auditing configured?


Patty

 

[wardog25]

I didn't realize the default domain controller policy was set like that. I changed it today, though, so hopefully once the the policy refreshes, the auditing will work correctly.

Thanks

 

[wardog25]

Ok, now I have another question. What good is auditing account logon events? I'm supposed to audit failed attempts for security purposes, but it's not easy to pick through all the audits that show up every day. Seems like there are a lot of audit failures. But they aren't failed logons, because then the account would get locked out.

They say stuff like error 676 "pre-authentication failed" or something like that.

Are these things significant or commonplace?