Having an issue with auditing a network for logins. I am looking for Event 4740 but the logs are not showing them. Neither on the local machines either.
I have verified that Account Management Auditing has been enabled and is set to Success And Failure and I have checked the Logon/Logoff policy for Account Lockout to Success. I have tested the account on a domain machine and the log on the machine shows the account failing but never logs that the account is locked out.
When I check the Domain Controllers it shows the account failed to login but is showing NULL SID. Even then it does not show the lockout event either.
Anyway to figure out why it is not logging the Lockout event with it enable to do so?