Failure audit events not being logged

Discussion in 'Server Security' started by Renato Martins, Jun 30, 2004.

  1. Hi all,

    does someone have an idea of what might be happening? I have a Windows
    Server 2003, for testing purposes. It's the only domain controller
    (actually, the only PC on my network). I've adjusted the "Default domain
    policy", so that the Success and Failuer of Account Logon and Logon Events,
    are audited (by going to "Computer configuration", "Security Settings",
    "Local Policies", "Audit policy").

    After having set this up, I try to logon with a valid user, entering the
    wrong password several times (for example, until account lockout). After
    that, logging as administrator, and analyzing the security log, in event
    viewer, I see no "Failure Audit" events. Only the "Success Audit" events...

    Is there a bug related to the logging of failed logon attempts??? Any clues
    on this?

    Thanks in advance.
    Renato Martins, Jun 30, 2004
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.