Windows 2000 Server security log

toil · 2003-11-11 09:30:14

Hi, i am wondering where i can look up on a windows 2000 server machine to see where people have logged in and out. I have an account that was block(i presume cos someone kept getting the wrong password) and i want to see what IP it was from and so forth.... Thanks toil

11-11-2003 09:30AM

#1

toil

Closed Accounts Posts: 599 ✭✭✭

Join Date: February 1998

Posts: 511

Hi,
i am wondering where i can look up on a windows 2000 server machine to see where people have logged in and out.

I have an account that was block(i presume cos someone kept getting the wrong password) and i want to see what IP it was from and so forth....

Thanks

toil

0

Comments

#2 11-11-2003 10:14AM

Hankster

Closed Accounts Posts: 36 ✭

Join Date: April 2001

Posts: 35

Surely this should already all be in your security log, provided you have auditing enabled that is.

You should then see a Type "Failure Audit" if someone didn't log on correctly, tried to change permsission or something similar without the sufficient rights. Try using the filter option on your event log and just have all the "Failure Audit" events showing.

To enable auditing, try the methods in this here article.

Sorry, I'm a wee bit rusty on all of this.

0