I read somewhere that DC's running 2003 would log a new event that
specifically indicated a workstation/member-server interactive login. Thus
this would provide a semi-consolidated record of domain users' interactive
logons from non-DC's. I've Googled repeatedly but I'm not finding the
information. Can someone tell me what this event number is?

Hello -,

Check this article about the logon type codes:
http://www.windowsecurity.com/articles/Logon-Types.html

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> I read somewhere that DC's running 2003 would log a new event that
> specifically indicated a workstation/member-server interactive login.
> Thus this would provide a semi-consolidated record of domain users'
> interactive logons from non-DC's. I've Googled repeatedly but I'm not
> finding the information. Can someone tell me what this event number
> is?
>

Thanks Meinholf,

I think what I'm trying to get at specifically is if the DC's are going to
start holding the events for interactive logons in addition to the
workstations.




"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news:(E-Mail Removed)...
> Hello -,
>
> Check this article about the logon type codes:
> http://www.windowsecurity.com/articles/Logon-Types.html
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> I read somewhere that DC's running 2003 would log a new event that
>> specifically indicated a workstation/member-server interactive login.
>> Thus this would provide a semi-consolidated record of domain users'
>> interactive logons from non-DC's. I've Googled repeatedly but I'm not
>> finding the information. Can someone tell me what this event number
>> is?
>>
>
>

<-> wrote in message news:(E-Mail Removed)...
> Thanks Meinholf,
>
> I think what I'm trying to get at specifically is if the DC's are going to
> start holding the events for interactive logons in addition to the
> workstations.

This is something you would need to enable manually using either a GPO or
the Local Domain Controller Policy. I would suggest to use a separate GPO
under the Domain Controller OU. Keep in mind, this is a lot of additional
data the DCs will be enumerating and can turn into a performance issue.

<-> wrote in message news:(E-Mail Removed)...
> Thanks Meinholf,
>
> I think what I'm trying to get at specifically is if the DC's are going to
> start holding the events for interactive logons in addition to the
> workstations.
>

Sorry, hit send too soon. I meant to post the following links:

Audit logon events: Security Configuration Editor; Security ServicesJan 21,
2005
If both account logon and logon audit policy categories are enabled, logons
that use a domain account generate a logon or logoff event on ...
http://technet.microsoft.com/en-us/l.../cc787567.aspx

Audit logon events
If you are auditing successful Audit account logon events on a domain
controller, then workstation logons do not generate logon audits. ...
http://technet.microsoft.com/en-us/l.../cc976395.aspx

How to Enable Success Logon Event Logging Dec 1, 2008
To enable success logon event logging using a local security policy ... In
the results pane, double-click Audit logon events and ensure that ...
http://technet.microsoft.com/en-us/l.../cc431373.aspx

Auditing Security Events Best practices: Auditing Jan 21, 2005
For information about how to enable auditing in the logon event category,
see Define or modify auditing policy settings for an event ...
http://technet.microsoft.com/en-us/l.../cc778162.aspx

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
(E-Mail Removed)

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.