Audit event issue

[Guest FallenNCantGetUp]

Okay, I've got a network running 4 domain controllers on server 2003.

Everything is 2003 or XP on the network. Account Logon/Logoff - Success/Fail

is configured on a GPO and applied to all workstations. The auditing

works, kinda. Two of my domain controllers successfully track Security

Events when a user logs on through one of the workstations. Specifically,

I'm testing for 'failed' log on events. The other two domain controllers,

don't record the events? They are tracking several security events, just not

my failed logon?

 

All DCs have the same GPO policy applied, and so far as I can tell aren't

having issues applying security settings? I'm confused. If anyone can shed

some insight, or perhaps a place to begin troubleshooting, would be very

grateful.

[Guest Meinolf Weber]

Re: Audit event issue

 

Hello FallenNCantGetUp,

 

For the DC's did you use the Default domain controllers policy or did you

create a new one and link that also to the DC's OU? Then check which one

is set as first level

 

Best regards

 

Meinolf Weber

Disclaimer: This posting is provided "AS IS" with no warranties, and confers

no rights.

** Please do NOT email, only reply to Newsgroups

** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm

> Okay, I've got a network running 4 domain controllers on server 2003.

> Everything is 2003 or XP on the network. Account Logon/Logoff -

> Success/Fail

> is configured on a GPO and applied to all workstations. The

> auditing

> works, kinda. Two of my domain controllers successfully track

> Security

> Events when a user logs on through one of the workstations.

> Specifically, I'm testing for 'failed' log on events. The other two

> domain controllers, don't record the events? They are tracking

> several security events, just not my failed logon?

>

> All DCs have the same GPO policy applied, and so far as I can tell

> aren't having issues applying security settings? I'm confused. If

> anyone can shed some insight, or perhaps a place to begin

> troubleshooting, would be very grateful.

>