Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » Logon/logoff event is not getting logged
Logon/logoff event is not getting logged [message #161529] Wed, 30 September 2009 04:17 Go to next message
RobW  is currently offline RobW  United States
Messages: 4
Registered: September 2009
Junior Member
In the security event log on my SBS 2003 server, successful
logon/logoff is not getting logged. I have the proper "success"
policies defined for this in the Domain Controller Security settings.
Consequently, my Barracuda 310 Web Filter will not work because it
relies on event 540 to authenticate users for content filtering.

Where would I start to diagnose and repair this? I know by default
the security logging is enabled on SBS 2003 so I don't know why this
one broke. There is no successful audits appearing. Only a failure
that pertains to one workstation with a SQL issue.

Thanks.


--
RobW
------------------------------------------------------------ ------------
RobW's Profile: http://forums.techarena.in/members/65084.htm
View this thread: http://forums.techarena.in/active-directory/1252889.htm

http://forums.techarena.in
Re: Logon/logoff event is not getting logged [message #161530 is a reply to message #161529] Wed, 30 September 2009 04:47 Go to previous messageGo to next message
Marcin  is currently offline Marcin  United States
Messages: 273
Registered: July 2009
Senior Member
As far as I understand, by default, SBS audits failed logon events only. Can
you describe steps you used to enable audit for successful logons?

hth
Marcin

"RobW" <RobW.3zbn3b@DoNotSpam.com> wrote in message
news:RobW.3zbn3b@DoNotSpam.com...
>
> In the security event log on my SBS 2003 server, successful
> logon/logoff is not getting logged. I have the proper "success"
> policies defined for this in the Domain Controller Security settings.
> Consequently, my Barracuda 310 Web Filter will not work because it
> relies on event 540 to authenticate users for content filtering.
>
> Where would I start to diagnose and repair this? I know by default
> the security logging is enabled on SBS 2003 so I don't know why this
> one broke. There is no successful audits appearing. Only a failure
> that pertains to one workstation with a SQL issue.
>
> Thanks.
>
>
> --
> RobW
> ------------------------------------------------------------ ------------
> RobW's Profile: http://forums.techarena.in/members/65084.htm
> View this thread: http://forums.techarena.in/active-directory/1252889.htm
>
> http://forums.techarena.in
>
Re: Logon/logoff event is not getting logged [message #161536 is a reply to message #161529] Wed, 30 September 2009 06:23 Go to previous messageGo to next message
pbbergs  is currently offline pbbergs  United States
Messages: 1024
Registered: July 2009
Senior Member
Have you followed the steps outlined in the link below? To simply state you
have auditting enabled, is not good enough to help. If you are unfamiliar
with this functionality, you may have thought you completed all of the steps
when in reality you missed something.

http://support.microsoft.com/kb/814595


--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"RobW" <RobW.3zbn3b@DoNotSpam.com> wrote in message
news:RobW.3zbn3b@DoNotSpam.com...
>
> In the security event log on my SBS 2003 server, successful
> logon/logoff is not getting logged. I have the proper "success"
> policies defined for this in the Domain Controller Security settings.
> Consequently, my Barracuda 310 Web Filter will not work because it
> relies on event 540 to authenticate users for content filtering.
>
> Where would I start to diagnose and repair this? I know by default
> the security logging is enabled on SBS 2003 so I don't know why this
> one broke. There is no successful audits appearing. Only a failure
> that pertains to one workstation with a SQL issue.
>
> Thanks.
>
>
> --
> RobW
> ------------------------------------------------------------ ------------
> RobW's Profile: http://forums.techarena.in/members/65084.htm
> View this thread: http://forums.techarena.in/active-directory/1252889.htm
>
> http://forums.techarena.in
>
Re: Logon/logoff event is not getting logged [message #161542 is a reply to message #161530] Wed, 30 September 2009 07:14 Go to previous messageGo to next message
RobW  is currently offline RobW  United States
Messages: 4
Registered: September 2009
Junior Member
Marcin, in the Domain Security Policy Audit account logon events and
Audit logon events have Success in the Policy Setting column.

I get successful audits for 'KSecDD' and
'MICROSOFT_AUTHENTICATION_PACKAGE_V1_0' for one user. Otherwise, no
logon/logoff audits.


--
RobW
------------------------------------------------------------ ------------
RobW's Profile: http://forums.techarena.in/members/65084.htm
View this thread: http://forums.techarena.in/active-directory/1252889.htm

http://forums.techarena.in
Re: Logon/logoff event is not getting logged [message #161543 is a reply to message #161542] Wed, 30 September 2009 07:30 Go to previous message
RobW  is currently offline RobW  United States
Messages: 4
Registered: September 2009
Junior Member
Thank you for the assistance here. I have many SBS 2003 installs under
my belt so I went back and checked the security event log on three
recent customers. I noticed by default logon/logoffs are getting
logged. Maybe this is just something specific to SBS that this would be
enabled.

Something must have happened recently with the SBS server I am working
on because I installed the Barracuda in February 2007 and the Barracuda
Domain Controller Agent was working and reading the logon events.

I suspect my customer may be at fault by installing some LOB
applications on the server. KB814595 is a good place to start and is
the type of article I was looking for.

Thanks


--
RobW
------------------------------------------------------------ ------------
RobW's Profile: http://forums.techarena.in/members/65084.htm
View this thread: http://forums.techarena.in/active-directory/1252889.htm

http://forums.techarena.in
Previous Topic:Question WinINSTALL LE
Next Topic:AD Migration & LCS 2005
Goto Forum:
  


Current Time: Tue Jan 23 16:16:46 MST 2018

Total time taken to generate the page: 0.09114 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software