Auditing Logon Failures Does Not Log Remote Failures

Article translations Article translations
Article ID: 172402 - View products that this article applies to.
This article was previously published under Q172402
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

SYMPTOMS

When auditing logon and logoff failures on a Domain Controller, not all expected failure audit event messages are recorded in the Security Event Log of a domain controller.

CAUSE

This behavior may occur if a user does not log on to a member Windows NT workstation or server by using an account that has domain credentials. In this case, the local Security Log records an Event 529 (Logon Failure) event message. There is no failure audit recorded on a domain controller when the domain user's logon does not succeed. The account may be locked out if configured to do so, but no event message is recorded.

RESOLUTION

You cannot force the domain controllers to log this failure audit. However there is an event message to audit the locking of an account on a domain controller. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
182918 Account Lockout Event Also Stored in Security Event Log on Domain Controller
For additional information about how to track the failed logon attempts on each workstation and member server, click the following article number to view the article in the Microsoft Knowledge Base:
171148 Automating Detection of Logon Failures in a Windows NT Domain

STATUS

Microsoft has confirmed that this is a problem in Windows NT 3.51 and Windows NT 4.0. Microsoft is researching this problem and will post more information in this article when the information becomes available.

Properties

Article ID: 172402 - Last Review: October 7, 2013 - Revision: 5.1
APPLIES TO
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
Keywords: 
kbnosurvey kbarchive kbnetwork KB172402

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com