Security Event Log and Logon Attempts

[Thomas M.]

Windows XP SP3

I would like to take a look at the logon events on my computer. I found on
the Microsoft site the following information about the Security log:

The security log records events such as valid and invalid logon attempts,
as well as events related to resource
use, such as the creating, opening, or deleting of files. For example,
when logon auditing is enabled, an event is
recorded in the security log each time a user attempts to log on to the
computer. You must be logged on as
Administrator or as a member of the Administrators group in order to turn
on, use, and specify which events are
recorded in the security log.

However, when I check my Security log all is see is a single entry called
Success Audit, and the date on that event looks like it is from the first
time some logged on to the computer. If I look at the properties for the
Security log I see that all event types are selected on the Filter tab.

How do I make is so that I can see all valid and invalid logon attempts in
the Security log?

--Tom

 

[Pegasus [MVP]]

Windows XP SP3

I would like to take a look at the logon events on my computer. I found
on the Microsoft site the following information about the Security log:

The security log records events such as valid and invalid logon
attempts, as well as events related to resource
use, such as the creating, opening, or deleting of files. For example,
when logon auditing is enabled, an event is
recorded in the security log each time a user attempts to log on to the
computer. You must be logged on as
Administrator or as a member of the Administrators group in order to
turn on, use, and specify which events are
recorded in the security log.

However, when I check my Security log all is see is a single entry called
Success Audit, and the date on that event looks like it is from the first
time some logged on to the computer. If I look at the properties for the
Security log I see that all event types are selected on the Filter tab.

How do I make is so that I can see all valid and invalid logon attempts in
the Security log?

--Tom

Run gpedit.msc, then follow this path: Local Computer Policy / Computer
Configuration / Windows Settings / Local Policies / Audit Policy. Now set
the desired logging level on the right side of the current screen.

 

[Jose]

Windows XP SP3

I would like to take a look at the logon events on my computer.  I found on
the Microsoft site the following information about the Security log:

   The security log records events such as valid and invalid logon attempts,
as well as events related to resource
   use, such as the creating, opening, or deleting of files. For example,
when logon auditing is enabled, an event is
   recorded in the security log each time a user attempts to log on to the
computer. You must be logged on as
   Administrator or as a member of the Administrators group in order to turn
on, use, and specify which events are
   recorded in the security log.

However, when I check my Security log all is see is a single entry called
Success Audit, and the date on that event looks like it is from the first
time some logged on to the computer.  If I look at the properties for the
Security log I see that all event types are selected on the Filter tab.

How do I make is so that I can see all valid and invalid logon attempts in
the Security log?

--Tom

Yes, as Pegasus says - auditing is not enabled by default.

You can also shortcut to the appropriate Group Policy Editor screen by
Start, Run, secpol.msc

What sometimes happens:

Going overboard with your "enabling" and the log constantly fills up
wiping out old events and soon you can't tell what the heck is going
on, so now you have to develop some maintenance strategy (maybe simple
at home) or turn down the auditing volume.

Auditing can also effect system performance if it is too loud and
logging every little thing...