Audit Failed Logon Events or Attempts in Active Directory

Step 1 – Enable ‘Audit Logon Events’

• • Run gpmc.msc command to open Group Policy Management Console

• • If you want to apply this on the whole domain then Right-click on the Domain Object and click on Create a GPO in this domain, and Link it here….

Note- If you do not want to apply this on the whole domain then you can select any OU rather selecting a domain.

• • Write a new GPO name as shown in below image

• • A new GPO “Logon Logoff Reports” created. Right click on this and click on Edit option

• • A new window of Group Policy Management Editor (GPME) will open.
  • Now under Computer Configuration go to Policies node and expand it as
    Policies -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy
  • In the right hand panel of GPME, either Double click on “Audit logon events” or Right Click -> Properties on “Audit logon events”
  • A new window of “Audit logon events” properties will open. Check “Success” and “Failure” boxes and click “Ok”

• Now, run gpupdate /force to update GPO

Now, we have successfully enabled “Audit Logon Events”

Step 2 – Enable ‘Audit Account Logon Events’

• • Run gpmc.msc command to open Group Policy Management Console.

• • Now, expand Domain Controllers node, Right-click on the “Default Domain Controllers Policy” and click “Edit”.

Note- You can also create your own GPO as we did for “Audit Logon Events” in case you do not want to edit Default Domain Controllers Policy.

• • A new window of Group Policy Management Editor (GPME) will open.
  • In GPME windows, expand Computer Configuration, go to “Policies” node and expand it as Policies -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy
  • In the right hand panel of GPME, either Double click on “Audit account logon events” or Right Click -> Properties on “Audit account logon events”
  • A new window of “Audit account logon events” properties will open. Check “Success” and “Failure” boxes and Click on “OK”

• Now, run gpupdate /force to update GPO

Now, we have successfully enabled “Audit account logon events”

Step 3 – Search Related Logon and Log Off Event Logs in Event Viewer

The event ids for “Audit logon events” and “Audit account logon events” are given below. You have to check these event ids in security logs to track successful logon / logoff and failed login attempts.

Audit Logon Events

Audit Account Logon Events

*Operating System for above ids – Windows Server 2008 or higher

Test Case – Here, we will search Event ID 4625 to track failed logins in Active Directory.

1. Go to “Start Menu” ➔ ”All Programs” ➔ ”Administrative Tools” ➔ “Event Viewer”
2. In the left panel, go to Windows Logs” ➔ “Security” to view the security logs → Click on ‘Filter Current Log..’
3. Enter Event ID 4625 to search for it
4. 4. Double-click on event to see its details like account name, date, and time of login failure.

Issues with Native Auditing

The native auditing of Active Directory has numerous drawbacks. Multiple events are generated for a single event and it is very difficult to search for a particular event in the large pool of events. Event Viewer also consumes a lot of disk space to store the events for the long term.

All the above-mentioned procedure to audit successful and failed Logon / Logoff in Active Directory can be simplified with the help of Lepide Active Directory Auditor. With this, you can make the entire auditing process simple and thus helps to maintain a secure AD environment.

How Lepide Active Directory Auditor tracks Logon/Logoff in Active Directory

Lepide Auditor for Active Directory overcomes the limitations of native auditing and provides an easiest way to track all the logon/logoff activities of Active Directory users. See below for an example of both successful logon/logoff activity and failed logins.

Figure 1: Successful User Logon Logoff report

Figure 2: Failed Logon Report

Lepide also makes it easy to spot potentially unwanted user behavior by reporting on when you Active Directory users are logging into Active Directory outside of business hours.

Figure 3: Failed Logon Report Outside Business Hours

Lepide is incredibly simple to install and configure and provides instant value through hundreds of pre-set reports. book a demo with one of our engineers today