This article describes how to monitor your system for unauthorized user access. There are two main steps: Enabling security auditing and viewing the security logs. Note that different systems have different security needs, and the security topic is complex. Any user who sets up security audits on your system must be assigned to administrative groups or be given security rights and privileges.

How to Enable Security Auditing

You set up security auditing differently depending on whether the computer is a standalone computer or a domain controller.

Standalone Servers, Member Servers, or Windows 2000 Professional

1.	Click Start, click Run, type mmc /a, and then click OK.
2.	On the Console menu, click Add/Remove Snap-in, and then click Add.
3.	Under Snap-in, click Group Policy, and then click Add.
4.	In the Select Group Policy Object box, click Local Computer, click Finish, click Close, and then click OK.
5.	In the Local Computer Policy box, click Computer Configuration, click Windows Settings, click Security Settings, click Local Policies, and then click Audit Policy.
6.	In the details pane, click Audit logon events.
7.	Click Action, click Security, select Unsuccessful logon attempts, and then click OK.

Windows 2000-Based Domain Controllers

1.	Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers
2.	In the console tree, click Domain Controllers.
3.	Click Action, and then click Properties.
4.	Click the Group Policy tab, click Default Domain Controllers Policy, and then click Edit.
5.	Click to expand Computer Configuration, Windows Settings, Security Settings, Local Policies, and then Audit Policy.
6.	In the details pane, click Audit logon events.
7.	On the Action menu, click Security, click to select the Define these policy settings check box, click to select the Failure check box, and then click OK.

 

How to View Security Logs

1.	Click Start, point to Programs, point to Administrative tools, and then click Event viewer.
2.	In the console tree, click Security log.
3.	Look in the details pane for information about the event you want to view, and then double-click the event.