LDAP/Active Directory - How to retrieve User login history, success and failures, VPN logins / On-Site Domain Controller logins etc.

Question

LDAP / Active Directory -

How can I retrieve User login history, login successes, and login failures, VPN logins / On-Site Domain Controller logins events etc. periodically using remote federated mechanisms ?

Any pointers are appreciated.

Answer 1

You can enable audit logs on the domain controller and check for that type of information. The audit logs include AccountLogon and LogonLogoff and show the user attempts to access a particular computer.

The security audit logs should show you these types of events. There's nothing LDAP specific there but they should give you what you're looking for. https://learn.microsoft.com/en-us/azure/active-directory-domain-services/security-audit-events

If you don't see these there may be an issue with your LDAP connection and I would suggest opening a support ticket.

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/security-audit-events

Answer 2

Thanks Marilee. This is super helpful. Is there anyway these commands as specified can be invoked from an external federated endpoint using a REST API interfaces. such as HTTP GET/POST etc..