locked
EVENT ID for LOGON & LOGON failed RRS feed

  • General discussion

  • Hi team,

    i want to see user logon and logon failed event ID in event viewer ..so please tell me the event ID for logon and logon failed for skype for business.. and where i can see that event . i,e In event viewer lync server or ususal applicaton log

    Examble like AD ..

    thanks and regards 

    surendar s


    Saturday, April 22, 2017 3:17 PM

All replies

  • Hi Surendar, 

    Secuirty log is the place where we can set an auditing to trigger about the  login failures 

    reference 

    https://technet.microsoft.com/en-us/library/dn720914%28v=ocs.15%29.aspx?f=255&MSPPError=-2147217396

    https://technet.microsoft.com/en-in/library/cc787567(v=ws.10).aspx


    Linus || Please mark posts as answers/helpful if it answers your question.

    Monday, April 24, 2017 8:08 AM
  • Hi,

    i think i have found it.. 4648 is the login failed event ID.. I hope

    Subject:
    Security ID: ITDEVELOPERS\administrator
    Account Name: administrator
    Account Domain: ITDEVELOPERS
    Logon ID: 0xCDCE2
    Logon GUID: {5a98c159-d70f-6a97-8f84-a0164b2157f2}

    Account Whose Credentials Were Used:
    Account Name: surendars@itdevelopers.com
    Account Domain: ITDEVELOPERS
    Logon GUID: {00000000-0000-0000-0000-000000000000}

    Target Server:
    Target Server Name: SVRSFB2.itdevelopers.com
    Additional Information: SVRSFB2.itdevelopers.com

    Process Information:
    Process ID: 0xf20
    Process Name: C:\Program Files\Microsoft Office\Office16\lync.exe

    Network Information:
    Network Address: -
    Port: -

    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

    PLS CHECK boss and tell me ..

    Monday, April 24, 2017 10:37 AM