logon failure audit

[M]

Archived from groups: microsoft.public.win2000.security (More info?)

I want to audit the event 529 (logon failure),
Do you know how can I get the pc name that the user used?

Thanks,

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

You also may want to audit account logon failures which may give additional
info. For domain user accounts account logon events would need to be enabled
in Domain Controller Security Policy. For local accounts it would need to be
enabled in Local Security Policy of the computer. If that does not help you
may need to use a software firewall to log traffic for that computer and
then match the firewall log with the security log by time. It could at least
give you an IP address. Sygate would be a good firewall for that and the
firewall function can be disabled which still allows the logging. --- Steve

http://www.snapfiles.com/Freeware/security/fwfirewall.html -- Sygate and
other firewalls available at this link.

"M" <M@discussions.microsoft.com> wrote in message
news:72E28284-97F2-441D-8E5D-E013DCD07183@microsoft.com...
>I want to audit the event 529 (logon failure),
> Do you know how can I get the pc name that the user used?
>
> Thanks,