cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Squack_the_Duck
Engaged Sweeper II
Hello i found this post to help create a report along the lines of what i would like to implement, searching and reporting for Event IDs relating to a logon failure:

https://www.lansweeper.com/forum/yaf_postsm49283_Invalid-login-attempts-on-Workstations.aspx#post49283

Yet when i run it i get no results and i know there are logon failures on computers. Is there an issue with Lansweeper being able to read the security logs? Do i need to enable something either in Lansweeper specifically or within the Windwos PCs/Servers i wish to be able to run reports against?

Thanks!

EDIT: don't get any results for any Event ID actually 😞
1 ACCEPTED SOLUTION
Esben_D
Lansweeper Employee
Lansweeper Employee
Did you enable the scanning of non-error events in Configuration\Server Options in the 'Eventlog scanning' section?

These are by default not scanned because they can exponentially grow your database.

View solution in original post

4 REPLIES 4
Squack_the_Duck
Engaged Sweeper II
Cheers dude!
Esben_D
Lansweeper Employee
Lansweeper Employee
Should be right. You can always check the event viewer to verify.

If you want to be sure you can always check the event viewer of a machine that had a failed login.

Squack_the_Duck
Engaged Sweeper II
Hello - no i didn't actually wasn't aware of such things at the time.

To just keep an eye out for login failure events i only need to tick the last of these options though. I'm assuming the Failure events is a same kind of Failure audit as event as failed logins, is that right?

Scan Warning events.
Scan Information events.
Scan Success audit events.
Scan Failure events.

Esben_D
Lansweeper Employee
Lansweeper Employee
Did you enable the scanning of non-error events in Configuration\Server Options in the 'Eventlog scanning' section?

These are by default not scanned because they can exponentially grow your database.