windows security auditing issue

Question

windows security auditing issue

محمد حازم 1

Hello All

I am trying to find field logins in a domain member server . OS windows server 2016
sub-auditing is enabled through GPO and below gpresult report screenshot for auditing.

I can find only failed login attempt for unknown users or users not exist in AD like Domain\UnknownUser
for known users or domain users I can not find any failed login attempts records even if I try to generate filed logins attempts by using my user or any other domain user.

Thanks

Anonymous

2021-04-13T05:50:44.17+00:00

Hi,
To understand the issue more clearly, please confirm the following questions:
Was the issue for all the member servers or one specific member?
Where did you link the audit GPO to?
Were there any successful logon events?
Which login attempts did you try to do?
For an interactive logon, the security audit event is generated on the computer that the user account logged on to.
For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource.

Best Regards,
Reza-Ameri 45,666 Reputation points Volunteer Moderator

2021-04-13T15:19:35.717+00:00

Have you checked the event viewer?
Have you tried different user to see whether failed login is being detected?
Anonymous

2021-04-21T02:31:27.867+00:00

Hi,
Welcome to share your current situation if there are any updates.
Please feel free to let us know if you need further assistance.

Best Regards,
Anonymous

2021-04-23T07:21:24.777+00:00

Any updates?
Best Regards,