Audit logon events

[sdabreo]

Dear All

We have Win2k3 servers and XP client machines in our office. I have created 3 different OU for eachdepartment in ADS and enabled the Audit logon events for both logon and logoff in GPO but events are not generated in system event viewer, I am not getting any error also. Where could be the problem.

In my other ADS events are generated , but i Couldn't understand certain things

1)
User Logoff:
User Name: LLSPL-25$ | Domain: ISMARTBLR | Logon ID: (0x0,0x112CBAE9) | Logon Type: 3

why i am getting llspl-25$, what you mean by $ system after the hostname.

2)
User Logoff:
User Name: ISMARTBLR3$| Domain:ISMARTBLR| Logon ID: (0x0,0x112CF3CA) | Logon Type: 3

ISMARTBLR3$ is my server hostname, what you mean by ISMARTBLR3$, it's showing as system in User

3)
User Name: ANONYMOUS LOGON| Domain: NT AUTHORITY | Logon ID: (0x0,0x112B23FE) | Logon Type: 3

How do i prevent anonymous logins, i haven't allowed anonymous logins at all.

Kindly help me to ..

Regards
Sakthi

 

[astaylor]

If your looking to audit just logon and logoff events in an easy way i would check out this post.

http://www.tek-tips.com/viewthread.cfm?qid=1383610&page=7

-drew

 

[sdabreo]

But why it's not generating any audit details in my system log events eventhough i enable it in my different OU's. How do i troubleshoot whether my GPO of the same properly deployed into my client pc's. I just need default logon events which is generated in win2k3 server.

Kindly help me