Where in the log to find successful/failed Windows machine authentication

KelvinT 1 Reputation point
2020-06-23T22:20:24.053+00:00

Hi,

Do anyone know where in Windows logs (event viewer, NETLOGON, etc.) to see a successful machine authentication or/and failure? On the client and server side.

If possible do you have log examples of both?

I found a few search results pointing to NETLOGON in system event viewer and enabling netlogon debug and viewing the netlogon.log. Neither gave a clear log showing success/failure.

Thanks.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,339 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,351 Reputation points Microsoft Employee
    2020-06-24T22:45:52.767+00:00

    @KelvinT-4181
    You should be able to view login history by using Windows Event Viewer.

    1. Press the WindowsIcon+ R and type “eventvwr.msc” and click OK or press Enter.
    2. Expand Windows Logs, and select Security.
    3. In the middle you’ll see a list, with Date and Time,Source, Event ID
      and Task Category. The Task Category pretty much explains the event,
      Logon, Special Logon, Logoff and other details.

    You can also follow this article to enable logon auditing utilizing your local GPO.

    Lastly, if this is a Windows platform specific question, please reference this forum for further troubleshooting.

    If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.

    0 comments