Chatee ahora con Soporte
Chat con el soporte

Change Auditor for Logon Activity 7.1.1 - Event Reference Guide

Introduction

Information about login and log out activity is important for regulatory compliance and user activity tracking. There are two auditing modules provided to allow you to collect this important activity:

This guide lists the events captured by these two Change Auditor for Logon Activity auditing modules. Separate event reference guides are available that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

 

Change Auditor for Logon Activity Events

This section lists the audited events captured by the two Change Auditor for Logon Activity auditing modules. They are listed in alphabetical order by facility:

Active Directory Federation Services - Sign-in

Successful Active Directory Federation Services sign-in

Created when a user successfully signs in through Active Directory Federation Services. (Disabled by default)

Low

Failed Active Directory Federation Services sign-in

Created when a user fails to sign in through Active Directory Federation Services. (Disabled by default)

Medium

Authentication Activity

Domain - Group Policy:

Workgroup - Local Group Policy:

User failed to log on interactively

Created when a user failed to log on interactively to a computer.

Windows Event equivalent: 529/4625

Medium

User failed to log on interactively from a remote computer

Created when a user failed to log on interactively from a remote computer.

Windows Event: 529/4625

Medium

User failed to perform a network logon from a remote computer

Created when a user failed to log on from a remote computer on the network. (Disabled by default)

Windows Event equivalent: 529/4625

Medium

User logged on interactively

Created when a user successfully logged on interactively to a computer.

Windows Event equivalent: 528/4624

NOTE: When logging onto a monitored Windows 2012 or 2012 R2 server or a Windows 8.1 workstation, you may see additional events with ‘Windows Manager\DWM-n’ in the who information. This is expected behavior because the logon is being performed by the system.

Medium

User logged on interactively from a remote computer

Created when a user successfully logged on interactively from a remote computer.

Windows Event equivalent: 528/4624

Medium

User performed a successful network logon from a remote computer

Crated when a user successfully logged on from a remote computer on the network. (Disabled by default)

Windows Event equivalent: 540/4624

Medium

User performed a successful NTLM V1 logon

Created when a user successfully logged into server through NTLM V1. (Disabled by default)

Medium

User performed a successful NTLM V2 logon

Created when a user successfully logged into server through NTLM V2. (Disabled by default)

Low

Herramientas de autoservicio
Base de conocimientos
Notificaciones y alertas
Soporte de productos
Descargas de software
Documentación técnica
Foros de usuarios
Tutoriales en video
Aviso de actualizaciones de páginas web (RSS)
Comuníquese con nosotros
Obtenga asistencia con las licencias
Soporte Técnico
Ver todos
Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación