Logon/logoff event is not getting logged

[RobW]

In the security event log on my SBS 2003 server, successful
logon/logoff is not getting logged. I have the proper "success"
policies defined for this in the Domain Controller Security settings.
Consequently, my Barracuda 310 Web Filter will not work because it
relies on event 540 to authenticate users for content filtering.

Where would I start to diagnose and repair this? I know by default
the security logging is enabled on SBS 2003 so I don't know why this
one broke. There is no successful audits appearing. Only a failure
that pertains to one workstation with a SQL issue.

Thanks.

As far as I understand, by default, SBS audits failed logon events only. Can
you describe steps you used to enable audit for successful logons?

hth
Marcin

"RobW" <RobW.3zbn3b@DoNotSpam.com> wrote in message
news:RobW.3zbn3b@DoNotSpam.com...
>
> In the security event log on my SBS 2003 server, successful
> logon/logoff is not getting logged. I have the proper "success"
> policies defined for this in the Domain Controller Security settings.
> Consequently, my Barracuda 310 Web Filter will not work because it
> relies on event 540 to authenticate users for content filtering.
>
> Where would I start to diagnose and repair this? I know by default
> the security logging is enabled on SBS 2003 so I don't know why this
> one broke. There is no successful audits appearing. Only a failure
> that pertains to one workstation with a SQL issue.
>
> Thanks.
>
>
> --
> RobW
> ------------------------------------------------------------------------
> RobW's Profile: http://forums.techarena.in/members/65084.htm
> View this thread: Logon/logoff event is not getting logged
>
> http://forums.techarena.in
>

Have you followed the steps outlined in the link below? To simply state you
have auditting enabled, is not good enough to help. If you are unfamiliar
with this functionality, you may have thought you completed all of the steps
when in reality you missed something.

http://support.microsoft.com/kb/814595


--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"RobW" <RobW.3zbn3b@DoNotSpam.com> wrote in message
news:RobW.3zbn3b@DoNotSpam.com...
>
> In the security event log on my SBS 2003 server, successful
> logon/logoff is not getting logged. I have the proper "success"
> policies defined for this in the Domain Controller Security settings.
> Consequently, my Barracuda 310 Web Filter will not work because it
> relies on event 540 to authenticate users for content filtering.
>
> Where would I start to diagnose and repair this? I know by default
> the security logging is enabled on SBS 2003 so I don't know why this
> one broke. There is no successful audits appearing. Only a failure
> that pertains to one workstation with a SQL issue.
>
> Thanks.
>
>
> --
> RobW
> ------------------------------------------------------------------------
> RobW's Profile: http://forums.techarena.in/members/65084.htm
> View this thread: Logon/logoff event is not getting logged
>
> http://forums.techarena.in
>

[RobW]

Marcin, in the Domain Security Policy Audit account logon events and Audit logon events have Success in the Policy Setting column.

I get successful audits for 'KSecDD' and 'MICROSOFT_AUTHENTICATION_PACKAGE_V1_0' for one user. Otherwise, no logon/logoff audits.

[RobW]

Thank you for the assistance here. I have many SBS 2003 installs under my belt so I went back and checked the security event log on three recent customers. I noticed by default logon/logoffs are getting logged. Maybe this is just something specific to SBS that this would be enabled.

Something must have happened recently with the SBS server I am working on because I installed the Barracuda in February 2007 and the Barracuda Domain Controller Agent was working and reading the logon events.

I suspect my customer may be at fault by installing some LOB applications on the server. KB814595 is a good place to start and is the type of article I was looking for.

Thanks