Windows login audit

The purpose of this post is to define the process to audit the successful or failed logon and logoff attempts in the network using the audit policies. It is required to enable these policies manually.

Before going to learn how to enable these policies, it is important to know in brief about them. Audit Logon Events policy defines the auditing of every user attempt to log on to or log off from a computer. The account logon events on the domain controllers are generated for domain account activities, whereas these events on the local computers are generated for the local user account activities.

Audit Account Logon Events policy defines the auditing of every event generated on a computer, which is used to validate the user attempts to log on to or log off from another computer. Such account logon events are generated and stored on the domain controller, when a domain user account is authenticated on that domain controller.

For local user accounts, these events are generated and stored on the local computer when a local user is authenticated on that computer. Please check your email including spam folder for a link to the whitepaper!

Anyone with the Manage auditing and security log user right can clear the Security log to erase important evidence of unauthorized activity.

Ensure that only the local Administrators group has the Manage auditing and security log user right. Restricting the Manage auditing and security log user right to the local Administrators group is the default configuration. Warning: If groups other than the local Administrators group have been assigned this user right, removing this user right might cause performance issues with other applications. Before removing this right from a group, investigate whether applications are dependent on this right.

Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode. Download Microsoft Edge More info. Contents Exit focus mode. Is this page helpful? Please rate your experience Yes No. Any additional feedback? Submit and view feedback for This product This page. View all page feedback. In this article.

A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password.