Hello,
I'm currently managing windows server 2008 DC's.Schema master and Infra master are at other location. I only have a primary and sec. server for my site. For security purpose, i need to monitor failed logons with user name. But for 95% of cases the user name is Blank or NA. I'm monitoring event ID 4625, please let me know what can be the issue?
Also, I'm not getting any event ID 4740 (account locked out) and 4723 (password change), even if there are locked accounts and password changes in the env.
I'm monitoring the events using a 3rd party application along with event logs from the server. So there are no changes of logs getting full or events are getting replaced/ deleted. There is issues for both the cases in application as well as event logs.
Please help
Regards,
Arnav Sharma
I'm currently managing windows server 2008 DC's.Schema master and Infra master are at other location. I only have a primary and sec. server for my site. For security purpose, i need to monitor failed logons with user name. But for 95% of cases the user name is Blank or NA. I'm monitoring event ID 4625, please let me know what can be the issue?
Also, I'm not getting any event ID 4740 (account locked out) and 4723 (password change), even if there are locked accounts and password changes in the env.
I'm monitoring the events using a 3rd party application along with event logs from the server. So there are no changes of logs getting full or events are getting replaced/ deleted. There is issues for both the cases in application as well as event logs.
Please help
Regards,
Arnav Sharma