Where in the log to find successful/failed Windows machine authentication

KelvinT 1 Reputation point
2020-06-23T22:20:24.053+00:00

Hi,

Do anyone know where in Windows logs (event viewer, NETLOGON, etc.) to see a successful machine authentication or/and failure? On the client and server side.

If possible do you have log examples of both?

I found a few search results pointing to NETLOGON in system event viewer and enabling netlogon debug and viewing the netlogon.log. Neither gave a clear log showing success/failure.

Thanks.

Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
12,758 questions
No comments
{count} votes

1 answer

Sort by: Most helpful
  1. JamesTran-MSFT 26,616 Reputation points Microsoft Employee
    2020-06-24T22:45:52.767+00:00

    @KelvinT-4181
    You should be able to view login history by using Windows Event Viewer.

    1. Press the WindowsIcon+ R and type “eventvwr.msc” and click OK or press Enter.
    2. Expand Windows Logs, and select Security.
    3. In the middle you’ll see a list, with Date and Time,Source, Event ID
      and Task Category. The Task Category pretty much explains the event,
      Logon, Special Logon, Logoff and other details.

    You can also follow this article to enable logon auditing utilizing your local GPO.

    Lastly, if this is a Windows platform specific question, please reference this forum for further troubleshooting.


    If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.

    No comments