Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The two Windows 7 computers I've tried so far are logging an Event ID 4625 when I fail to logon to the domain. The problem is that the server (2008 R2 SP1) is not capturing this event as well. Other events like password changes, etc show up.

What could possibly stop event 4625 from showing up on the server as well?

I'm using the Default Domain Policy to test this. This is what I've got set.

Local Policies/Audit Policy

  • Audit logon events = Success, Failure (to set default for XP machines)

Local Policies/Security Options

  • Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings = Enabled

Advanced Audit Configuration Account Logon

  • Audit Credential Validation = No Auditing
  • Audit Kerberos Authentication Service = No Auditing
  • Audit Kerberos Service Ticket Operations = No Auditing

Account Management

  • Audit Computer Account Management = Success, Failure
  • Audit Other Account Management Events = Success, Failure
  • Audit User Account Management = Success, Failure

Logon/Logoff

  • Audit Account Lockout = Success, Failure (not sure which is which exactly)
  • Audit Logoff = Failure
  • Audit Logon = Failure (I've added Success to this and the server does log them)
  • Audit Other Logon/Logoff Events = Failure
  • Audit Special Logon = Failure
share|improve this question
    
Keep in mind that the Default Domain Controllers Policy defines some logging settings by default, which would take precedence over the Default Domain Policy. Are those set as desired, too? –  Shane Madden Oct 28 '11 at 0:29
    
All of the Audit settings in the Default Domain Controllers Policy are Not Configured. "auditpol /get /category:*" shows that the policy outlined above is applied correctly. If a user logs into a domain account on any computer in the domain it should record a 4625 right? –  ltguide Oct 28 '11 at 3:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.