Event ID 529; Login Failures not Being Recorded in Event Log

[lifegard2]

I am noticing that Event 529 is not being recorded in my DC security event logs when a user login fails. I have auditing for Login/Logoff Success and Failure turned on. However, after 10/8/02, I stopped receiving posts for login failures.

I am about to undergo a network validation where I have to prove that NT does this and works properly, but it's not. Any help would be greatly appreciated.

I did find KB article Q182918, but it looks like it's a pre SP4 fix. So, it should be a safe bet that the fix has been incorporated into SP6a (which I am running on my PDC and BDCs).

I am thinking about just reinstalling SP6a to see if it clears up. Any ideas?

 

[djhawthorn]

Do you have more than one DC? MCSE NT4/W2K

 

[lifegard2]

Yup. One PDC (obviously) and three BDCs. I've checked the security event logs on each and nodda until the user's acct is locked out (3 attempts).

 

[Walter349]

Just to cover the obvious, have you made sure that the log views are not being filtered? and have you checked the logs on all the Authenticating servers?

 

[lifegard2]

yes and yes. I'm actually using dmpevt to dump the event logs into a text file, so it's getting everything. I've also checked all the DC logs immediately after attempting a failed login.

 

[Walter349]

I found this, it might be of help

Knowledge Base

Account Lockout Event Also Stored in Security Event Log on Domain ControllerPSS ID Number: Q182918

Article Last Modified on 08-9-2001