How to activate security auditing for failed logon attempts?

How to activate security auditing for failed logon attempts?

Rating:

Take the following steps to activate security auditing for failed logon attempts:

1. Run Console Root from Start Menu > Run > MMC.
   
   



2. In the Console Root window, click File > Add/Remove Snap-in menu.
   
   



3. In the Add/Remove Snap-in dialog box, click the Add button.
   
   



4. In the Add Standalone Snap-in dialog box, select Group Policy Object Editor in the Available Standalone Snap-ins section, and click the Add button.
   
   



5. On the Welcome to the Group Policy Wizard page, specify the Group Policy Object, and click the Finish button.
   
   



6. In the Add/Remove Snap-in dialog box, click the OK button.
   
   



7. In the Console Root window, click Local Computer Policy to expand the tree, expand Computer Configuration, expand Security Settings, expand Local Policies, and click Audit Policy. In the details pane, double-click Audit logon events.
   
   



8. In the Audit logon event properties dialog box, select the Failure check box under the Audit these attempts option in the Local Security Setting tab page, and click the OK button.
   
   

Rating: