Security report for audit requirements

[donjohnson]

Hello!
We have a request from an auditor to produce a report of logon failures (bad password, user unknown, etc.). They would like to see a report by userid (to identify multiple cracking attempts) and by IP or machine (to identify attempts at multiple logonids).

Being new to AD and event management, how can I meet this request?

Thanks!

Don Johnson

 

[donjohnson]

Does anyone have any suggestions for security reporting?

Don

 

[Binkie3010]

donjohnson,

You will probably need a third party tool to help track and report on the event logs required. When you have a moment, check out SysTrack from Lakeside Software. (

http://www.LakesideSoftware.com)

They have an easy to use tool, which will monitor and help generate reports on event id's.

Good luck!

 

[donjohnson]

Thanks for the tip - I will look at Lakeside soon!

Don