Configure the Audit Policy in the Default Domain GPO to audit success/failure of Account Logon Events and Logon Events. You can use a free utility such as EventCombMT ( http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9989D151-5C55-4BD3-A9D2-B95A15C73E92) to collect the audit data from several machines into a single location for easy viewing and analysis.
Dig Deeper on Enterprise Infrastructure Management
Related Q&A from Laura Hunter
Active Directory expert Laura E. Hunter explains to a reader what must be done to change the default display specifiers for new users in Active ...continue reading
Active Directory expert Laura E. Hunter offers some advice for changing the IP addresses of domain controllers.continue reading
Active Directory expert Laura E. Hunter tells a reader what to keep in mind when deleting subnets associated with sites being removed in an ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.