Windows 2003/2000 Domain Failed Login Attempt logging

A_Price_UK · Guest

Hi all,

With our old Windows 2000 Domain, It logged all failed domain logon attempts.

For example I go to a workstation on the domain, login with a wrong username
and/or password, and then the domain controller will have a "Failure Audit"
entry in the security event log. This enabled me to track failed login
attempts.

However now we have put a brand new Windows 2003 server based domain in, it
is not doing this logging. I have searched for a way of re-enabling this but
not had much luck.

Is there anyone who can advise me on;

a) How I can have workstation failed logins to display on the Domain
Controllers event log?
b) Is there any documentation anywhere giving a list of the relevent error
codes (i.e which event id numbers are logged when failure audit's occur). I
know in windows 2000 they were event id's 529, 530, 531 and a few more.