We have a network with 1 primary domain controller and 3 additional domain controllers.
We're trying to identify a user who attempted to use someone else's credentials to access some resources in our organization. At this point we want to see from what computers there were failed logon attempts with that respective user.
We enabled on the PDC success & failure audits for Account logon event & logon event and I made some tests from my computer.
The failed attempt is indeed logged in Event Viewer but the client IP is totally wrong (it's not logging my IP it's logging one of the additional domain controllers). What do I need to do to track the REAL ip?
I assume the workstation connects to the first available domain controller, and that DC authenticates to the PDC. But how do I solve this?
EDIT As stated in the comments, I looked on the ADC that was reported by the PDC but there were no failed log on attempts. The security policy settings seem to apply to all DC's from the domain so it should have logged it...
On a related note I made some tests with an XP workstation: I enabled object access auditing, added the users to track, also enabled log on auditing; but it logs ONLY the username, not the ip (or at least the name) of the workstation - not even in the logon security report!!!.
I gotta say I'm really disappointed with these features from a product that sells itself as enterprise level. Either that, or I'm doing something wrong and I could use some pointers.