PDC Security events not being listed

[westgate]

Hi - I've got a domain running a pdc and no bdc's (don't ask! - we'll be moving them to a new 2K3 domain with backup controllers asap) When checking the security event log most of the logon/off events are not listed, although some are. Any ideas where the others have gone as this should be the only server validating users?
Thanks in advance
Ed

 

[WhoKilledKenny]

Check the filter options in Event Viewer. It may be set to show only the Events that you are seeing...

 

[westgate]

Unfortunately its set to show all, and does list some logon/offs, but only about 10%. Its as if theres a bdc somewhere thats also validating attempts even though I'm sure there isn't...
Thanks for your time
Ed

 

[GlenJohnson]

Have you checked for a rouge controller? Does anybody bring in a laptop? Just a thought.

Glen A. Johnson
If you like fun and sun, check out Tek-Tips Florida Forum

 

[westgate]

Thanks Glen, That could well be it. I'll have a play about with browstat and see what turns up. cheers Ed

 

[TigerfanLSU]

You have to turn on Auditing from User Manager and check the Logon/Logoff options.

User Manger - Policies - Audit