Audit log set up for domain

[leoatul]

I am running a network with all Windows 2000 computers. I want to set up a Audit log for everyone who logs into their computers in the domain. I know I can do it through the Windows 2000 server OS on my Domain Controller (server).

I went to the ‘Domain Security policy’ and started ‘Audit logon events’ on the primary domain controller but if I go to my ‘Security log’ in the event viewer I don’t see anything. I would appreciate if some one could tell me if I am missing a step?


Thanks a lot.

 

[sdibias]

You're on the right track.

You need to enable auditing fopr "Account Logon Events" which is different from "logon Events". Once you enable this setting you can choose track succesful, failed or both types of logon events.

After enabling this policy give it a test by logging in with the wrong password or something similar.

This should be done using the "Domain Controller Security Policy" snap-in from the DC. In the snap-in's edit window, maneuver to Local Policies, Audit Policy. Right-click Audit account logon events in the right pane, and select Security to open the Security Policy Setting dialog box. To enable the category, select the Success and Failure check boxes and save the settings. . . .



Visit www.netwerkin.com
MCSE 2000, MCSA, MCP, A+