Security Auditing - Logon failure

[Ken Krause]

I have an AD enabled network using Win2k servers. This
network has about 35 servers under 2 domain controllers.
Occasionally, when a user tries and fails to logon, the
event is recorded in several miscellaneous servers
throughout the network. In the AD Group Policy, I have
auditing configured to record login failures and successes.

Has anyone run into this before?

TIA
Ken

 

[Steven Umbach]

Failed logons will also be recorded on any computer where a user tried to access
a share or logon locally with a domain account and was denied access due to bad
credentials if auditing of logon events is enabled on that computer. The link
below may be of some help. -- Steve

http://www.microsoft.com/technet/tr...curity/prodtech/win2000/secwin2k/09detect.asp
http://tinyurl.com/vtyv --- same link as above in case of wrap.