Server Management

Hi,

I need to check the audit log for the domain controller events on windows server 2012 R2; i.e. successful login and failure login attempt of domain users.

I have followed below steps but could able to see success/failure audit logs, please help.

1. In the group policy management, edit the "Default domain policy" and "Default domain controllers policy".

2. Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies and click Audit Policy, then double click Audit account logon events..



3. In the Audit account logon events Properties, click Define these policy settings box, and then select both the Success and Failure boxes and click OK.

4. and also the created the new GPO and perform the above steps 2 and 3 and associate GPO with Domain and Domain controllers.

5. Perform logon at other machine (windows 8.1) with correct password and wrong password.

6. checked the Eventvwr (local) -> windows logs -> security in 2012 R2 server but the success and failure audit logs for logon events are not displayed.

Please suggest how to view/log domain controller audit logs.

I have taken reference from below article:

https://mizitechinfo.wordpress.com/2014/06/30/domain-log-on-auditing-in-windows-server-2012-r2/

Thank You