Where in the log to find successful/failed Windows machine authentication

KelvinT 1 Reputation point


Do anyone know where in Windows logs (event viewer, NETLOGON, etc.) to see a successful machine authentication or/and failure? On the client and server side.

If possible do you have log examples of both?

I found a few search results pointing to NETLOGON in system event viewer and enabling netlogon debug and viewing the netlogon.log. Neither gave a clear log showing success/failure.


Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,451 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. JamesTran-MSFT 36,531 Reputation points Microsoft Employee

    You should be able to view login history by using Windows Event Viewer.

    1. Press the WindowsIcon+ R and type “eventvwr.msc” and click OK or press Enter.
    2. Expand Windows Logs, and select Security.
    3. In the middle you’ll see a list, with Date and Time,Source, Event ID
      and Task Category. The Task Category pretty much explains the event,
      Logon, Special Logon, Logoff and other details.

    You can also follow this article to enable logon auditing utilizing your local GPO.

    Lastly, if this is a Windows platform specific question, please reference this forum for further troubleshooting.

    If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.

    0 comments No comments