How to log all AD successful/failed logon into Domain Controller

[CT]

Under existing configuration, AD user's successful and
failed logon records will be logged to the user's local XP
workstation (Security Log of event viwer). Is there any
means or tools that can redirect all the AD user's
successful/failed logon records to the Domain Controller
or Backup Domain Controller instead of logging to user's
local XP?

Thanks.

 

[Herb Martin]

Audit: Account Logon Events (rather than Logon Events.)

 

[CT]

Do you mean:
Group Policy -> Computer Configuraiton -> Windows Setings -

Local Policies -> Audit Policy

Any document/article explains the difference
between "Account Logon Events" and "Logon Events".

Thanks.

 

[Ben Verhagen]

Google found:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/gp/518.asp

hth.

 

[Herb Martin]

Any document/article explains the difference

between "Account Logon Events" and "Logon Events".

Oddly enough not many (did you search TechNet) until Win2003,
although this was added in Win2000.

Account logon events collect at the DC(s) - precisely what you requested.