Issue Generating EventID 540 on Sever 2003 Domain Controllers

in order integrate web filter appliance, need able generate event 540 in security logs of our 2 domain controllers.  both running server 2003 sp2.  in default domain controller security policy have set both audit account logon events , audit logon events success, failure.  according documentation, should needed generate logon events on our dc's.  can see events kerb tickets being generated, nothing regarding general account logons.

is there group policy settings hindering generation of event 540's?

any appreciated.

hi,

 

please run rsop.msc on domain controllers verify settings audit logon events , audit account logon events correct.

 

the event 540 generated when user or computer logged on computer network. if rsop.msc shows audit settings correct, please access share folder on domain controller domain workstation , check if event 540 generated in security log.

 

thanks.

Windows Server  >  Windows Server General Forum