tcdrake wrote: > Thanks for the reply. Your right, I needed to add more info. My plan > was to audit the DC which the users account would be authenticated > with. The users PC is XP and is on the LAN. I would rather use the DC > for this as that means less client roll outs on my end. Any additional > help would be appreciated.
You'll want to look at the 6x events on a domain controller. For example, 672 is a successful logon. 675 with a failure code 0x18 is generally a failed password. Also look for 680 and so on which indicates NTLM instead of Kerberos if that is relevant to your environment. And don't forget that someone can stay logged in and simply unlock their workstation. Alternatively, you can let OSSEC do the heavy lifting and just write a rule to match on authentication_success or authentication_failed, the computer name and the user name. I have audited this and contributed some rules here, so I know it's pretty robust. Just keep in mind that sometimes the user name is not captured by OSSEC, so you'll have to use the <match> tag. This is Windows being weird. You'll find lots of good info here: http://www.ultimatewindowssecurity.com/encyclopedia.html Register for and download the Security Log Quick Reference Chart. It's pretty handy. HTH, Mike
