Security Event Viewer SBS 2011 RRS feed

  • Question

  • We recently migrated our SBS 2003 to SBS 2011. I would get notified when attacks were made to the SBS 2003. In the security event viewer sbs 2003 it would display the not valid user ID event 529. I do not seem to get any notifications that attempts are being made to log onto our server/network. I believe they would still be randomly occurring. Is there any way that sbs 2011 could notify so I can verify that our network has not been breached?




    Wednesday, December 14, 2011 1:57 PM


All replies

  • Hi Terry, you can check if the following links work for you:

    Alert for Logon Failure

    Custom Filter for Failed Logon @ Server

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, December 16, 2011 8:45 AM
  • Hi Sean,


    Thanks for the response.I tried the second solution and get an error that the event log query specified is not valid.



    Friday, December 16, 2011 7:23 PM
  • Hi Terry, I hope you have followed the each step in the link. Can you post the exact error message you received?

    Sean Zhu

    TechNet Community Support

    Tuesday, December 20, 2011 5:39 AM