IP address of failed logons in Windows 2003 Server

[Dana]

Why the event viewer does not give the IP address of failed logons and only
shows the source workstation, especially when the workstation is not local
to my LAN.

for ex:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 5/14/2004
Time: 3:19:50 PM
User: NT AUTHORITY\SYSTEM
Computer: STATION_1
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: BNO
Source Workstation: \\COSMOS
Error Code: 0xC0000064

BTW, I have the standard addition of Win 2003 Server



Thanks

 

[Rob]

Why?
It aint built to do that.

 

[Steven L Umbach]

You should be able to find the IP address of lan workstations if you need them for
some reason. However I would be more concerned as to why "not local" workstations are
showing up. That could indicate that your firewall/router is not configured correctly
and you should scan your firewall to make sure that only authorized ports, if any,
are open. If you want the IP address of non local computers, then make sure the times
are in synch on your computer and firewall and look in the logs for what computers
are trying to gain access at the same time the failed logon appears in the security
log. --- Steve