event 540, 528 and password change event questions

[rdgordon]

I have auditing turned on for success and/failure on the default domain group policy for audit account logon events and logon events.
Anyway everything appears to be working fine for 2 weeks since domain upgrade...users login, get mappings, access resources...i have tons of events id 540 showing up but no 528...
Is this normal...
Also i don't seem to be able to view the events, i forget the number, when users change they're passwords.

interestingly these events are loggin on the local users pc's event logged...

but shouldn't i be able to look at the DC's event log to see the evnets...


Thanks

 

[rdgordon]

Anyone?