Security log - not logging failed login attempts

[Tara]

I have security logging turned on, and group policies for
the domain controllers have security logging enabled
(failed and successful login attempts).

However, when I look at the security logs on one of my
DC's, I do not see any failed login attempts. I have
purposely locked out an account; however, it only shows
successful logins and logoffs on my DC's security log.

Any suggestions?

Thanks!

 

[Paul Bergson {MCT, MCSE}]

Are you auditing logon events or account logon events? From what it sounds
like you want to watch account logon events and they need to be set at the
domain level.

Paul Bergson MCT, MCSE, CNE, CNA, CCA

 

[Tara]

Correct - I want to watch account logon events. I
checked by Group Policy at the domain level, and it is
set to log both success and failure for account logon
events; however, I am still not seeing failed logins in
my security log.

Thanks