/build/static/layout/Breadcrumb_cap_w.png

Server Management Question


Not able to check/view domain controller audit events

05/16/2017 875 views
Hi,

I need to check the audit log for the domain controller events on windows server 2012 R2; i.e. successful login and failure login attempt of domain users.

I have followed below steps but could able to see success/failure audit logs, please help.

1. In the group policy management, edit the "Default domain policy" and "Default domain controllers policy".

2. Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies and click Audit Policy, then double click Audit account logon events..



3. In the Audit account logon events Properties, click Define these policy settings box, and then select both the Success and Failure boxes and click OK.

4. and also the created the new GPO and perform the above steps 2 and 3 and associate GPO with Domain and Domain controllers.

5. Perform logon at other machine (windows 8.1) with correct password and wrong password.

6. checked the Eventvwr (local) -> windows logs -> security in 2012 R2 server but the success and failure audit logs for logon events are not displayed.

Please suggest how to view/log domain controller audit logs.

I have taken reference from below article:

https://mizitechinfo.wordpress.com/2014/06/30/domain-log-on-auditing-in-windows-server-2012-r2/

Thank You

0 Comments   [ + ] Show comments

Comments


Be the first to answer this question

Don't be a Stranger!

Sign up today to participate, stay informed, earn points and establish a reputation for yourself!

Sign up! or login

Share

 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ