Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a network with 1 primary domain controller and 3 additional domain controllers.

We're trying to identify a user who attempted to use someone else's credentials to access some resources in our organization. At this point we want to see from what computers there were failed logon attempts with that respective user.

We enabled on the PDC success & failure audits for Account logon event & logon event and I made some tests from my computer.

The failed attempt is indeed logged in Event Viewer but the client IP is totally wrong (it's not logging my IP it's logging one of the additional domain controllers). What do I need to do to track the REAL ip?

I assume the workstation connects to the first available domain controller, and that DC authenticates to the PDC. But how do I solve this?

Thank you!

EDIT As stated in the comments, I looked on the ADC that was reported by the PDC but there were no failed log on attempts. The security policy settings seem to apply to all DC's from the domain so it should have logged it...

On a related note I made some tests with an XP workstation: I enabled object access auditing, added the users to track, also enabled log on auditing; but it logs ONLY the username, not the ip (or at least the name) of the workstation - not even in the logon security report!!!.

I gotta say I'm really disappointed with these features from a product that sells itself as enterprise level. Either that, or I'm doing something wrong and I could use some pointers.

share|improve this question
    
Have you tried looking at the DC it gave you the IP address for and tracing from there? –  Dustin Aug 10 '10 at 15:11
    
Yep. I tried there but there were no failed logons. The DCs do inherit the audit settings from the PDC, don't they? –  Bogdan Aug 10 '10 at 18:55

1 Answer 1

The DC that processes the request will have an event in its event log with the clients IP.

Is this 2003 or NT4?

Also have a read of this document, it was a huge help in us tracking down which client was causing a similar issue.

Technet: Maintaining and Monitoring Account Lockout

Cheers...Gary

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.