We have AD Auditor and in search and reports we have a lot of user accounts with details N/A that have failed logon action. What would be some suggestions how to troubleshoot and discover which accounts are that really?
Hello @aleksandar.m, thank you for posting. Incomplete logon details such as you are experiencing, with the user listed as N/A or unknown can normally be an indicator that the required audit policies are not in place.
I would recommend confirming the below audit policies are configured on your domain controllers.
You can also have Auditor set the policies for you automatically by utilizing our ‘Adjust audit settings automatically’ option within the ‘edit data source’ menu of the monitoring plan.
Our support team is also more than happy to assist you in troubleshooting this issue further. As well as, walking you through the recommended troubleshooting steps.
If you have any further questions, please let me know.
-Thank You
1 Like