Configure the Audit Policy in the Default Domain GPO to audit success/failure of Account Logon Events and Logon Events. You can use a free utility such as EventCombMT ( http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9989D151-5C55-4BD3-A9D2-B95A15C73E92) to collect the audit data from several machines into a single location for easy viewing and analysis.
Dig Deeper on Enterprise infrastructure management
Related Q&A from Laura Hunter
Active Directory expert Laura E. Hunter offers a tip for shortening client wait times. Continue Reading
Active Directory expert Laura E. Hunter explains to a reader what must be done to change the default display specifiers for new users in Active ... Continue Reading
Active Directory expert Laura E. Hunter tells a reader what to keep in mind when deleting subnets associated with sites being removed in an ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.