Pls tell me the exact difference between "Audit Account Logon Events" and "Audit Logon Events"

Discussion in 'Windows Server' started by Spin, Jun 28, 2004.

  1. Spin

    Spin Guest


    Regarding auditing of domain logins by my network users, I am unclear of the
    advantages of auditing for "Audit Account Logon Events" versus straight-up
    "Audit Logon Events". These seem to me to be one and the same.
    Spin, Jun 28, 2004
    1. Advertisements

  2. Spin

    Nina Harris Guest

    Spin wrote
    here's the definition from latest msdn

    Determines whether to audit each instance of a user logging on, logging off,
    or making a network connection to this computer.

    If you are auditing successful Audit account logon events on a domain
    controller, then workstation logons do not generate logon audits. Only
    interactive and network logons to the domain controller itself generate
    logon events. In short, "account logon events" are generated where the
    account lives. "Logon events" are generated where the logon occurs.

    By default, this value is set to No auditing in the Default Domain
    Controller Group Policy object (GPO) and in the local policies of
    workstations and servers.

    If you define this policy setting, you can specify whether to audit
    successes, audit failures, or not to audit the event type at all. Success
    audits generate an audit entry when logon occurs successfully. Failure
    audits generate an audit entry when an attempted occurrence of the logon
    fails. You can select No auditing by defining the policy setting and
    unchecking Success and Failure.
    Nina Harris, Jun 28, 2004
    1. Advertisements

  3. Spin

    Spin Guest


    Spin, Jun 28, 2004
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.