Hi, I have a problem with one of our windows server 2003 , where we unable to sight the ip address of the source workstation for failure logon and successfull logon in security log. This server is join to AD domian. The source ip address give null value. I would to know if anyone encounter this scenario before and any idea how to solve this problem? Rgds

Hi Mariya85, Thanks for posting here Could you post a full audit log entry here as a sample? Or you may like perform a test ,try access to this computer from other computers, and check if the resource computer value is blank. Thanks. Tiger Li Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Mariya85, Recently I found a post which discuss similar situation for you reference. http://www.spywarepoint.com/security-log-failure-audit-t43720.html If there is any update on this issue, please feel free to let me know. Thanks. Tiger Li Important Note: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.