none
Failed Logon Events Not Logging

    Question

  • Audit account logon events are currently set for Success and Failure, unfortunately, the failed login logs are no where to be found and not working ( EventID 4625 ).

    https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625

    Already tried this, but it is not working:

    http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/NPS-2008-user-auth-and-fails-not-showing-in-eventviewer/m-p/18120#M1017

    OS is Windows Server 2008 R2 Enterprise and joined to a domain.

    Thursday, July 16, 2015 6:52 AM

Answers

  • Meanwhile, I find an informative resource that covers the same concern in order to audit successful logon/logoff and failed logons in Active Directory : http://www.lepide.com/blog/audit-successful-logon-logoff-and-failed-logons-in-activedirectory/

    Hope, it might helps you.

    Thursday, July 16, 2015 7:20 AM