Centralizing Account Lockout events (Event ID 539) to only..

Archived from groups: microsoft.public.win2000.security (More info?)

I'm the NA for a bank and we use "Intrust for Events" to log and report our
account lockouts (regulatory requirement). In the past, we've only polled our
DC's for lockouts. We just migrated to 2003, and I've found the client now
records the lockout and the DC doesn't seem to get a carbon copy of the
lockout (539). In my reading, it appears 2003 treats lockouts differently and
"offloads" the event recording to the client PC, whcih the client dutifully
records, but not the DC.

Does anyone know of a way to have all "domain" security events sent to one
of the DC's? Even if the client could somehow CC the DC. It would be a real
PITA to have to coordinate the capture of 200 client's security logs, and not
to mention the cost of licensing for 197 PC's instead of 3 DC's.

Any ideas would be greatly appreciated!!

Thanks!!
1 answer Last reply
More about centralizing account lockout events event only
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    Make sure that you have auditing of account management enabled in Domain
    Controller Security Policy. You should see events 644 and 642 recorded on
    the pdc fsmo domain controller when an account is locked out. I have not
    verified that for Windows 2003 but it is worth checking. The link below
    shows that event ID 644 still exists on W2003 for account management
    auditing.

    http://www.microsoft.com/technet/security/guidance/secmod128.mspx

    Otherwise you can use Event Comb to scan the security logs of multiple
    computers for specific events and log them to a text file if that is
    helpful. --- Steve

    http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
    -- Event Comb available here.


    "CFB" <CFB@discussions.microsoft.com> wrote in message
    news:E75E134C-C2E8-4AAA-A891-83452D27B03A@microsoft.com...
    > I'm the NA for a bank and we use "Intrust for Events" to log and report
    > our
    > account lockouts (regulatory requirement). In the past, we've only polled
    > our
    > DC's for lockouts. We just migrated to 2003, and I've found the client now
    > records the lockout and the DC doesn't seem to get a carbon copy of the
    > lockout (539). In my reading, it appears 2003 treats lockouts differently
    > and
    > "offloads" the event recording to the client PC, whcih the client
    > dutifully
    > records, but not the DC.
    >
    > Does anyone know of a way to have all "domain" security events sent to one
    > of the DC's? Even if the client could somehow CC the DC. It would be a
    > real
    > PITA to have to coordinate the capture of 200 client's security logs, and
    > not
    > to mention the cost of licensing for 197 PC's instead of 3 DC's.
    >
    > Any ideas would be greatly appreciated!!
    >
    > Thanks!!
Ask a new question

Read More

Security Events Event Id Windows