Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Group Policy: Audit All Failed Logon Attempts


  • Please log in to reply
2 replies to this topic

#1 Treikayan

Treikayan

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:35 PM

Posted 24 July 2007 - 11:55 AM

Hello,

I would like to have an e-mail sent everyday of all failed logon attempts. First, I have defined the proper group policy in Active Directory, but I don't know which server will have all this information stored.

Secondly, I would like to have a VBScript send an e-mail of all failed attempts everyday. Below, I have a partial script created (to send to a document), but I don't know how to send it through e-mail. Please help. I would like to schedule a task everyday to run this script, but it has to be on the server where the logon attempts are being stored.

Dim objFSO, objTS, strComp, objWMIService, WBEMlocator, SWBEMlocator, UserName, Password, colItems
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTS = ObjFSO.OpenTextFile("S:\Logs\LoginFailure.txt")
Do until objTS.AtEndOfStream
strComp = "."
UserName = ""
Password = ""
Set WBemlocator = CreateObject("WBemScripting.SWBemLocator")
Set objWMIService = SWBemLocator.ConnectSever(strComp, _
"\root\CIMV2",UserName,Password)
Set colItems = _
objWMIService.ExecQuery("Select * from Win32_NTLogEvent")
For Each objItem in colItems
If objItem.EventIdentifier = 538 Then
WScript.Echo "TimeGenerated: " & objItem.TimeGenerated
Wscript.Echo "TimeWritten: " & objItem.TimeWritten
Wscript.Echo "User: " & objItem.User
Wscript.Write "Found Event ID"
End If
Next
Loop
objTS.close


Procrastinate Now!!!

BC AdBot (Login to Remove)

 


#2 need TOS

need TOS

  • Members
  • 888 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Akron,OH
  • Local time:11:35 PM

Posted 24 July 2007 - 09:43 PM

Wouldn't programing be a better topic for this post?

-Steve
Forgiveness is forgetting about a past that could have been

#3 Treikayan

Treikayan
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:35 PM

Posted 26 July 2007 - 08:21 PM

Wouldn't programing be a better topic for this post?

-Steve


I don't know. Can the moderators move this topic???
Procrastinate Now!!!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users