The two Windows 7 computers I've tried so far are logging an Event ID 4625 when I fail to logon to the domain. The problem is that the server (2008 R2 SP1) is not capturing this event as well. Other events like password changes, etc show up.
What could possibly stop event 4625 from showing up on the server as well?
I'm using the Default Domain Policy to test this. This is what I've got set.
Local Policies/Audit Policy
- Audit logon events = Success, Failure (to set default for XP machines)
Local Policies/Security Options
- Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings = Enabled
Advanced Audit Configuration Account Logon
- Audit Credential Validation = No Auditing
- Audit Kerberos Authentication Service = No Auditing
- Audit Kerberos Service Ticket Operations = No Auditing
- Audit Computer Account Management = Success, Failure
- Audit Other Account Management Events = Success, Failure
- Audit User Account Management = Success, Failure
- Audit Account Lockout = Success, Failure (not sure which is which exactly)
- Audit Logoff = Failure
- Audit Logon = Failure (I've added Success to this and the server does log them)
- Audit Other Logon/Logoff Events = Failure
- Audit Special Logon = Failure