would like to audit Domain Admin logon
How could I audit Domain Admin account logon of DCs ?
July 18th, 2012 10:46pm
Please refer to this:
Audit logon events
http://technet.microsoft.com/en-us/library/cc787567(v=ws.10)
Regards,
MiyaMiya Yao
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
July 19th, 2012 1:40am
Thank you for your reply.
Unfotunately I could not follow the link you wrote.
July 19th, 2012 4:41am
Try this:
http://technet.microsoft.com/en-us/library/dd408940(v=WS.10).aspx
and look for the section "To configure an advanced domain logon audit policy setting".
Cheers, Ramin
Free Windows Admin Tool Kit Click here and download it now
July 19th, 2012 9:26am
Thank you.
I saw advanced domain logon .
There are AccountLongon, LogonLogoff,PrivilegeUse,etc.
Which policy is suitable for Domain Admin Usage audit, and which event ID is created when Admin logon ?
July 19th, 2012 11:24pm