Sounds like you lost your audit policies when you replaced the PDC.
Check them on the PDC with "User Manager for Domains" | policies |
audit policy. You should also check account policies, user rights
assignment, etc to insure they are what you want configured.
-----Original Message-----
From: Eddie Willett [mailto:eddie.willett (at) richmond.ppdi (dot) com [email concealed]]
Sent: Monday, November 10, 2003 5:27 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: MS event logging
I run NT domain. A while back I changed my PDC. I retired the old
server and for a few reasons added a new server with the same name and
ip address as the PDC. Ever since then my domain controllers don't
appear to be logging login failures correctly. Does anyone have any
idea what the probelm could be? I don't know what other info might be
relevant but I will be happy to give it if you can tell what you need to
know.
Eddie
______________________________________________________________________
This email transmission and any documents, files or previous email
messages attached to it may contain information that is confidential or
legally privileged. If you are not the intended recipient or a person
responsible for delivering this transmission to the intended recipient,
you are hereby notified that you must not read this transmission and
that any disclosure, copying, printing, distribution or use of this
transmission is strictly prohibited. If you have received this
transmission in error, please immediately notify the sender by telephone
or return email and delete the original transmission and its attachments
without reading or saving in any manner.
------------------------------------------------------------------------
---
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
------------------------------------------------------------------------
---
Check them on the PDC with "User Manager for Domains" | policies |
audit policy. You should also check account policies, user rights
assignment, etc to insure they are what you want configured.
-----Original Message-----
From: Eddie Willett [mailto:eddie.willett (at) richmond.ppdi (dot) com [email concealed]]
Sent: Monday, November 10, 2003 5:27 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: MS event logging
I run NT domain. A while back I changed my PDC. I retired the old
server and for a few reasons added a new server with the same name and
ip address as the PDC. Ever since then my domain controllers don't
appear to be logging login failures correctly. Does anyone have any
idea what the probelm could be? I don't know what other info might be
relevant but I will be happy to give it if you can tell what you need to
know.
Eddie
______________________________________________________________________
This email transmission and any documents, files or previous email
messages attached to it may contain information that is confidential or
legally privileged. If you are not the intended recipient or a person
responsible for delivering this transmission to the intended recipient,
you are hereby notified that you must not read this transmission and
that any disclosure, copying, printing, distribution or use of this
transmission is strictly prohibited. If you have received this
transmission in error, please immediately notify the sender by telephone
or return email and delete the original transmission and its attachments
without reading or saving in any manner.
------------------------------------------------------------------------
---
Network with over 10,000 of the brightest minds in information security
at the largest, most highly-anticipated industry event of the year.
Don't miss RSA Conference 2004! Choose from over 200 class sessions and
see demos from more than 250 industry vendors. If your job touches
security, you need to be here. Learn more or register at
http://www.securityfocus.com/sponsor/RSA_focus-ms_031027
and use priority code SF4.
------------------------------------------------------------------------
---
[ reply ]