In order to fully integrate with a Web Filter Appliance, we need to be able to generate Event 540 in the security logs of our 2 Domain Controllers. Both are running Server 2003 with SP2. In the Default Domain Controller Security Policy I have set both Audit account logon events and Audit logon events to Success, Failure. According to all documentation, that should be all that is needed to generate the logon events on our DC's. I can see events for Kerb tickets being generated, but NOTHING regarding general account logons.Is there another Group Policy Settings that could be hindering the generation of Event 540's?Any help would be greatly appreciated.

Hi, Please run rsop.msc on the Domain Controllers to verify that the settings for the Audit logon events and Audit account logon events are correct. The event 540 is generated when a user or computer logged on to this computer from the network. If the rsop.msc shows that the audit settings are correct, please access a share folder on the Domain Controller from a domain workstation and check if the event 540 is generated in the security log. Thanks.

hi there, inline to joson suggestion , event id 540 is logged when user logged on to the network and the corresponding event id is 3 along with 540 . Being said that are you calling these audit logs from your application ? is there a service related to your webappliance ?if so what is the logon account used to start and stop the service ?sainath !analyze