1

We have a network with 1 primary domain controller and 3 additional domain controllers.

We're trying to identify a user who attempted to use someone else's credentials to access some resources in our organization. At this point we want to see from what computers there were failed logon attempts with that respective user.

We enabled on the PDC success & failure audits for Account logon event & logon event and I made some tests from my computer.

The failed attempt is indeed logged in Event Viewer but the client IP is totally wrong (it's not logging my IP it's logging one of the additional domain controllers). What do I need to do to track the REAL ip?

I assume the workstation connects to the first available domain controller, and that DC authenticates to the PDC. But how do I solve this?

Thank you!

EDIT As stated in the comments, I looked on the ADC that was reported by the PDC but there were no failed log on attempts. The security policy settings seem to apply to all DC's from the domain so it should have logged it...

On a related note I made some tests with an XP workstation: I enabled object access auditing, added the users to track, also enabled log on auditing; but it logs ONLY the username, not the ip (or at least the name) of the workstation - not even in the logon security report!!!.

I gotta say I'm really disappointed with these features from a product that sells itself as enterprise level. Either that, or I'm doing something wrong and I could use some pointers.

2
  • Have you tried looking at the DC it gave you the IP address for and tracing from there?
    – Dustin
    Aug 10, 2010 at 15:11
  • Yep. I tried there but there were no failed logons. The DCs do inherit the audit settings from the PDC, don't they?
    – Bogdan
    Aug 10, 2010 at 18:55

1 Answer 1

0

The DC that processes the request will have an event in its event log with the clients IP.

Is this 2003 or NT4?

Also have a read of this document, it was a huge help in us tracking down which client was causing a similar issue.

Technet: Maintaining and Monitoring Account Lockout

Cheers...Gary

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .