0
votes
1answer
38 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
0
votes
1answer
18 views

Log user access in a windows domain

I need to log all users access to computer in a mysql database. I need datetime, user and workstation, how to do it? How to set up an event on domain controllers?
2
votes
2answers
609 views

How to collect Security Event Logs for a single category via Powershell

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the ...
0
votes
0answers
38 views

How to record AD EventLog that LDAP authentication failure of account that does not exist?

I tried the LDAP authentication to ActiveDirectory from Linux. I was able to confirm that the authentication of the account to the existing successful / failure remains in the event log. But I do not ...
1
vote
2answers
145 views

How to use imported text in a variable in powershell

I want an automatic AD unlock with some users. I use this to import the info in a text file Get-EventLog -LogName Security -ComputerName COMP -InstanceId 4740 -Newest 1 | Format-List >> ...
3
votes
2answers
207 views

What's this odd logon failure I see every day?

I'm having something weird happen on a Windows Server 2008 R2 server. Every day at exactly 9:00 PM, an Audit Failure is registered in Event Viewer, saying that an account failed to log on for reason ...
2
votes
2answers
212 views

Event 34 on Windows 2008 R2 write cache and sysvol on system drive

I have Windows Server 2008 R2 running as Active Directory Primary Domain Controller. Since our domain is not large, I put the SYSVOL and NTDS folders in the default location on the system drive (SSD ...
0
votes
1answer
91 views

AD: delegating computer log access

I would like to setup the following audit scenario: A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
1
vote
2answers
55 views

Lots of Failure Alerts on my DC

I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit. Please see the below print-screen for more detail. The logon type is 3, that means it is a ...
2
votes
1answer
550 views

Failed Account Logon Events

We have a server running SQL 2008 R1. We have a web server in the DMZ that connects through the firewall to the SQL server and executes SQL Reporting Services reports using a domain user account. On ...
0
votes
3answers
1k views

Exchange 2010: Event id 9554 for deleted mailbox

I've deleted a mailbox and it's user in Exchange 2010. Now I'm getting the following warnings in the event log of the Exchange server: Unable to update Mailbox SD in the DS. Mailbox Guid: ...
1
vote
1answer
114 views

Determine what exe is running under a given SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may ...
4
votes
2answers
4k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
1
vote
1answer
2k views

Server 2008 Audit Failure Event Logs

I am having trouble figuring out what is causing massive audit failures on a server 2008 system. the event id is 4771 Account Name: Administrator Service Name: krbtgt/DOMAIN.NAME Client Address: ::1 ...
4
votes
1answer
2k views

Where can I view active directory failed logon attempts?

I do not see any failed logon attempts in my windows sever 2003 security event log (I see only successful ones). However, I have a user that is getting locked out very often and I need to try to ...
1
vote
1answer
162 views

How to report who, when and which computer has logged on to a domain controller

I'm completing an audit and need to know the following information below. I have a domain controller with active directory, but let me know if you need any more info. I would like something as simple ...
2
votes
1answer
729 views

How to differentiate between users and computers in EventID 4768 - Active Directory?

I monitor EventID 4768 on an Active Directory server to catch user logons. So far so good ... I observed that all events with user set to $ are computers. My problem is, that as far as I can see, I ...
0
votes
1answer
60 views

aggregate local events in AD

How can I aggregate events from event viewer log (logins with local Administrator) from all computers (atleast the servers - 2003,2008,2008r2) in an AD domain?
2
votes
3answers
1k views

Can Windows logoff events be tracked?

I'm working on an application to track network user logon/logoff events in an Active Directory domain; the application will work by auditing security logs on domain controllers. Auditing logon events ...
1
vote
1answer
8k views

How to avoid Master Browser errors, MRxSmb Event ID 8003?

I have a domain with Windows SBS 2003 as domain controller. It's very common to get Master Browser errors in the logs, MRxSmb Event ID 8003. How can I avoid that? What have I done wrong? I know how ...
2
votes
2answers
2k views

Event ID for modified GPOs

I have to know, who (usersid or loginname) changed a specified GPO for a specified OU in the Active Directory. Given our audit settings include this, what would be the right Event ID to look for?
0
votes
1answer
1k views

Event 10016 When Running ntbackup as a user in the Backup Operators group

I created a Windows 2003 AD user and deployed the user to the local Backup Operators group via Restricted Group on Default Domain Policy. I then restarted a client to make sure that this user was ...
5
votes
8answers
38k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
4
votes
2answers
155 views

Is there a way to search all the event-logs on a LAN for a specifc event?

Is there a way to search all the event-logs on a LAN for a specifc event?