3
votes
2answers
678 views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
1
vote
0answers
93 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
130 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
1
vote
3answers
10k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...