1

Having an issue with auditing a network for logins. I am looking for Event 4740 but the logs are not showing them. Neither on the local machines either.

I have verified that Account Management Auditing has been enabled and is set to Success And Failure and I have checked the Logon/Logoff policy for Account Lockout to Success. I have tested the account on a domain machine and the log on the machine shows the account failing but never logs that the account is locked out.

When I check the Domain Controllers it shows the account failed to login but is showing NULL SID. Even then it does not show the lockout event either.

Anyway to figure out why it is not logging the Lockout event with it enable to do so?

2
  • Is the account being locked out?
    – Greg Askew
    Nov 20, 2015 at 18:41
  • I may have found the answer. The NULL SID led me to create a new account and then try an lock myself out. When I did that the event started working again. Not sure what caused the NULL SID as I have done no work to it but seems to be working now.
    – JukEboX
    Nov 20, 2015 at 20:07

0

You must log in to answer this question.

Browse other questions tagged .