7 replies to this topic

[Perks]

Hi,

 

Just testing ALE and seem to be getting the Audit Status shows "Logon auditing is disabled" message. I believe i have configured group policy correctly as per https://www.netwrix.com/kb/1571. 

 

Also, when a list of locked out accounts is provided should i be able to use the 'Examine' option if there is no workstation provided?

 

Thanks.

[Perks]

This is my auditpol /get /category:* report:

 

Microsoft Windows [Version 6.3.9600]

© 2013 Microsoft Corporation. All rights reserved.

 

C:\Windows\system32>auditpol /get /category:*

System audit policy

Category/Subcategory                      Setting

System

  Security System Extension               No Auditing

  System Integrity                        Success and Failure

  IPsec Driver                            No Auditing

  Other System Events                     Success and Failure

  Security State Change                   Success

Logon/Logoff

  Logon                                   Success and Failure

  Logoff                                  Success

  Account Lockout                         Success

  IPsec Main Mode                         No Auditing

  IPsec Quick Mode                        No Auditing

  IPsec Extended Mode                     No Auditing

  Special Logon                           Success

  Other Logon/Logoff Events               No Auditing

  Network Policy Server                   Success and Failure

  User / Device Claims                    No Auditing

Object Access

  File System                             No Auditing

  Registry                                No Auditing

  Kernel Object                           No Auditing

  SAM                                     No Auditing

  Certification Services                  No Auditing

  Application Generated                   No Auditing

  Handle Manipulation                     No Auditing

  File Share                              No Auditing

  Filtering Platform Packet Drop          No Auditing

  Filtering Platform Connection           No Auditing

  Other Object Access Events              No Auditing

  Detailed File Share                     No Auditing

  Removable Storage                       No Auditing

  Central Policy Staging                  No Auditing

Privilege Use

  Non Sensitive Privilege Use             No Auditing

  Other Privilege Use Events              No Auditing

  Sensitive Privilege Use                 No Auditing

Detailed Tracking

  Process Creation                        No Auditing

  Process Termination                     No Auditing

  DPAPI Activity                          No Auditing

  RPC Events                              No Auditing

  Plug and Play Events                    No Auditing

Policy Change

  Authentication Policy Change            Success

  Authorization Policy Change             No Auditing

  MPSSVC Rule-Level Policy Change         No Auditing

  Filtering Platform Policy Change        No Auditing

  Other Policy Change Events              No Auditing

  Audit Policy Change                     Success

Account Management

  User Account Management                 Success

  Computer Account Management             Success

  Security Group Management               Success

  Distribution Group Management           Success

  Application Group Management            Success

  Other Account Management Events         Success

DS Access

  Directory Service Changes               Success

  Directory Service Replication           Success

  Detailed Directory Service Replication  Success

  Directory Service Access                Success

Account Logon

  Kerberos Service Ticket Operations      Success

  Other Account Logon Events              Success

  Kerberos Authentication Service         Success

  Credential Validation                   Success

 

C:\Windows\system32>

[Kirill K]

Hi there,

 

you have incorrectly configured auditing policies, look at the statement from the documentation:

"Set the Audit Account Management parameter to 'Success', and Audit Logon Events and Audit Account Logon Events to 'Failure'."

 

I could not reproduce the similar scenario, but you may go ahead and try to use Examine option, then please let me know the result.

 

Also, when a list of locked out accounts is provided should i be able to use the 'Examine' option if there is no workstation provided?

[Perks]

Please ignore, waiting for group policy to update.....

[Perks]

Hi,

 

Under Audit Polices i'v checked account logon are all failure, account management are all success and under local policies audit account logon event is failure also.

 

Thanks.

[Netadmin]

Hi Team,

 

I am not getting the detailed information on logins.

I have set the domain GPOs and even local GPOs on multiple machines on domain controllers and I still get this error message when I examine a locked out account.

 

 

 

ALE Netwrix is running as a full domain admin.

It is checking all our domain controllers with a green OK and it quickly returns users who are locked out in testing and with actual occurrences.

However, some of these events are costing us a lot of time determining what process or action is causing the lockouts and without the detailed information we are stuck.

 

The first attachment shows the actual error we need help fixing:

"To view detailed information on logons, enable Failure Audit logon policy on the target workstation"

 

The next 2 attachments are showing the server/DC the Netwrix tool is running on and the Workstation that the lockout shows it occurred on an actual user as per the auditpol /get /category:*

 

I am seeing everything set right from other forums but I must be missing something.

 

Attached Files

•  ALE netwrix audit log failure one xamine.PNG   2.94KB   0 downloads
•  netwrix audit policy 1.PNG   268.95KB   0 downloads
•  netwrix audit policy 2.PNG   34.47KB   0 downloads

[Netadmin]

Hi Team,

 

Any update on this?

[Kirill K]

Hi there,

 

Have you enabled failure audit logon policy on the target workstation?