Domain Controller's Security log

hello.

we're running windows server 2008 x64 domain controller. want track domain account's logon or log off details when users log on workstation domain account.

in event id 4624 :

new logon:
security id:  mydoamin\test-pc1
account name: test-pc1
account domain: mydoamin
logon id:  0x39bc1b295
logon guid:  {bffd9d77-a960-0e19-bb69-618193fc8873}

process information:
process id:  0x0
process name:  -

network information:
workstation name:
source network address: 172.16.xx.xxx
source port:  59150

detailed authentication information:
logon process: kerberos
authentication package: kerberos
transited services:

here is not showing workstation name , domain user or domain account and in event id 4624  "account name" are showing times hostname of computer and times domain user logon name. in above event example account name is showing hostname of computer test-pc1.

what reason behind ? please share knowledge.

regards

khurshid

you can enable security auditing in active directory , track logon/logoff events per requirement. please check article summarizes steps asked concern : http://www.lepide.com/blog/audit-successful-logon-logoff-and-failed-logons-in-activedirectory/

Windows Server  >  Directory Services