Windows Forum

Ask something
Discussion Locked

644 Event ID's not logged

0 helpful
5 replies

by eclipse860

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Windows 2000 AD domain. I have auditing turned on for...

Audit Account Logon Events - Success and Failure
Audit Account Management - Success and Failure
This is on the Domain Controllers OU.

The security logs on my DC's are logging 681, 676, 675

It is NOT logging any 644 event ID's for account lockouts. I have checked the security logs on all my DC's. Anyone know why they might not be logged and how to fix it?

5 replies

by eclipse860

Thanks for the link BFilmFan. I have used those tools, they are excellent. Unfortunatly, they did tell me what server locked out the accounts but not why the 644's were being logged. It turned out being the logging options on the Security log. I had to increase the storage size. I was getting some events but only if the log wasnt already full. So all the testing I did was not getting logged. I have since tweaked the settings and now everyhting is being logged including the 644's.

by razz2

You mention that you have auditing turned on, but... OK I have
to ask...have you implemented the needed account policies such
as Account Lockout Threshold?

Also, I love BFilmFan's link. How did I miss those tools. Thanks.

Good Luck,

razz

by eclipse860

Sorry, I thought I had replied to everyone on this. I guess I need to choose an option to "Rate this Answer" sorry. Anyway, I do have all auditing options turned on. The problem turned out to be my Security log was hitting its max every day so the additional testing I was doing was not being logged. I changed the logging options and everything works now.

This discussion is closed to new replies.