none
Security Event Viewer SBS 2011 RRS feed

  • Question

  • We recently migrated our SBS 2003 to SBS 2011. I would get notified when attacks were made to the SBS 2003. In the security event viewer sbs 2003 it would display the not valid user ID event 529. I do not seem to get any notifications that attempts are being made to log onto our server/network. I believe they would still be randomly occurring. Is there any way that sbs 2011 could notify so I can verify that our network has not been breached?

     

    Thanks,

    Terry

    Wednesday, December 14, 2011 1:57 PM

Answers

All replies

  • Hi Terry, you can check if the following links work for you:

    Alert for Logon Failure
    http://sbs.codeplex.com/releases/view/18545

    Custom Filter for Failed Logon @ Server
    http://sbs.codeplex.com/releases/view/23747


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, December 16, 2011 8:45 AM
    Moderator
  • Hi Sean,

     

    Thanks for the response.I tried the second solution and get an error that the event log query specified is not valid.

     

    Terry

    Friday, December 16, 2011 7:23 PM
  • Hi Terry, I hope you have followed the each step in the link. Can you post the exact error message you received?


    Sean Zhu

    TechNet Community Support

    Tuesday, December 20, 2011 5:39 AM
    Moderator