In this demonstration we'll see how to configure authentication related audit policies in server manager.
I'll click tools manual and then click Group Policy Management in group policy management console and
the navigation penile expand forest a datum dot com domains and group also objects and then select the
default domain controller as policy.
The right click the default domain controller as policy and then click added in the Group Policy Management
Editor window in the navigation I'll expand computer configuration policies windows certain security
servants local policies and then click audit policy and in the details pane I'll double click ordered
account log on arounds and then expand the configuration options.
So if you select the defined these policies sentence checkbox the policy is applied.
If you select success only success audits are logged and if you select failure only failure audits are
locked.
I'd like to point out that if multiple policies contains a certain and it is defined differently.
Their success and failure options apply based on the last applied policy that defined low sentence.
If one policy defines success audits and in other defines failure audits.
They do not merge.
Click define these policies sentence select both the success and failure checkboxes and then click Okay.
Now in the details Spain I'll double click audit account log on at once click the explained tab and
you can read the explanation of this policy here.
No I'll click Cancel to closely audit my account log on one's properties dialog box we can repeat the
same steps for audit log on a policy as we did for audit account log on events now in the group Paul
is a management editor a window in the navigation pane.
I'll maybe get to computer configuration policies windows certain security settings advanced audit policy
configuration audit policies and then click audit policies and in the audit policies policy we can find
10 main categories and will double click account log on.
We'll have subcategories here and we'll double click.
Audit Gerber US authentication service.
And as you can see the this subcategory has the same settings as in the audit policy audit account log
on Saddam but they are now on a more detailed level and to allow a more selective audit him.
Now let's select configure the following audit events select success and select failure and then click
apply.
We can also read the explanation in the explain tab here.
Now let's see how to view log on events.
First on Lowndes C1 I'll open command prompt and type GP update slash for and then press enter.
I'll wait until the policy has been updated and then switch to the start screen and click the administrator
icon and then click sign out.
Then I'll try to sign in with another user which is a data and backslash Aden with her own password.
I'll type 1 2 3 4.
I'll get the message that the user name or password is incorrect and click Okay.
Then I'll sign in with Administrator second and turn the server manager.
I'll click tools and then click event viewer and an event for you're in the navigation pane and expand
windows locks and then click security and in the details pane I'll lock key to the event I.D..
4 2 7 7 2 1.
It's an audit failure rewound.
Let's double click.
They went failure ordered failure.
Sorry.
And as we can see that event was locked when Aiden tried to sign in with the wrong password.
Now let's lucky to went I.
Forty seven sixty eight and we can see that it's an ordered success around this event was locked when
administrator assigned in successfully.