Reporting login failures

[Squack_the_Duck]

Hello i found this post to help create a report along the lines of what i would like to implement, searching and reporting for Event IDs relating to a logon failure:

https://www.lansweeper.com/forum/yaf_postsm49283_Invalid-login-attempts-on-Workstations.aspx#post49283

Yet when i run it i get no results and i know there are logon failures on computers. Is there an issue with Lansweeper being able to read the security logs? Do i need to enable something either in Lansweeper specifically or within the Windwos PCs/Servers i wish to be able to run reports against?

Thanks!

EDIT: don't get any results for any Event ID actually 😞

[Squack_the_Duck]

Cheers dude!

[Esben_D]

Should be right. You can always check the event viewer to verify.

If you want to be sure you can always check the event viewer of a machine that had a failed login.

[Squack_the_Duck]

Hello - no i didn't actually wasn't aware of such things at the time.

To just keep an eye out for login failure events i only need to tick the last of these options though. I'm assuming the Failure events is a same kind of Failure audit as event as failed logins, is that right?

Scan Warning events.
Scan Information events.
Scan Success audit events.
Scan Failure events.

[Esben_D · Accepted solution]

Did you enable the scanning of non-error events in Configuration\Server Options in the 'Eventlog scanning' section?

These are by default not scanned because they can exponentially grow your database.