Configure the Audit Policy in the Default Domain GPO to audit success/failure of Account Logon Events and Logon Events. You can use a free utility such as EventCombMT (http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9989D151-5C55-4BD3-A9D2-B95A15C73E92) to collect the audit data from several machines into a single location for easy viewing and analysis.
This was first published in May 2004
Join the conversationComment
Share
Comments
Results
Contribute to the conversation