Security in Windows 2000

Question

Security in Windows 2000

Nebby-271858

SSC Rookie

Points: 25
More actions
October 31, 2005 at 6:05 am

#110733

Please can someone tell me if the Server tracks failed log on attempts when someone is not connected to the network (i.e on a laptop). Is there a way of setting this up?

Viewing 6 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic. Login to reply

Don Staten SSC Eights! Points: 957 More actions · Answer 1

With Security Auditing enabled (http://support.microsoft.com/default.aspx?scid=kb;en-us;300958), you will be able to track logon attempts regardless of whether or not the user is logging in locally or remotely through the network.

Don

Nebby-271858 SSC Rookie Points: 25 More actions · Answer 2

How about if they are not trying to connect to the server, but are just trying to log onto their local machine under administrator? When they reconnect to the server, can this be traced?

Don Staten SSC Eights! Points: 957 More actions · Answer 3

Are you attempting to log Windows authentication? Or attempts to access SQL Server? I am confused by your scenario... can you provide more details?

Nebby-271858 SSC Rookie Points: 25 More actions · Answer 4

Hi,

Sorry to confuse.

Some of my staff have laptops that they remove from the docking station and take home. What I want to know is that if they try and log in as Administrator (for example), will that be recorded anywhere when they return their laptop to the docking station?

Don Staten SSC Eights! Points: 957 More actions · Answer 5

OK... I think I follow now. So you want to be able to check their laptop (upon connecting to the server) to see if they have attempted to log in as Administrator (or other account - on their laptop) when the laptop was undocked?

If I am correct in this assumption, then the same answer (above) still applies... assuming the operating system on the laptop is Windows 2000 (or XP). Once Security Auditing is enabled on a Windows 2000 operating system, any attempts (undocked, docked, networked, not networked) to log into the operating system will be logged in the Security log. These logs can be manually viewed using the Event Viewer.

The logs can also be read programmatically using WMI. For more information on how to do this, read the following Microsoft article:

http://msdn.microsoft.com/library/en-us/dnclinic/html/scripting06112002.asp?frame=true

There is a small section that provide code on how to read the event logs.

Hope this answers your question.