Hi,
I was monitoring my server (w2k3) using the counter "\server\errors logon" in perfmon. The explanation to this counter is: "The number of failed logon attempts to the server. Can indicate whether password guessing programs are being used to crack the security on the server."
In perfmon I was able to see the number of errors increase. So, I opened the event viewer in order to see the details. But I found nothing. I was expecting to find events from 529 up to 537 (and 539). But I didn't found a single logon failure...
So, is there an explanation why perfmon shows logon errors and why event viewer doesn't register then?
TIA Bob
Bob
