We have AD Auditor and in search and reports we have a lot of user accounts with details N/A that have failed logon action. What would be some suggestions how to troubleshoot and discover which accounts are that really?
Hello @aleksandar.m, thank you for posting. Incomplete logon details such as you are experiencing, with the user listed as N/A or unknown can normally be an indicator that the required audit policies are not in place.
I would recommend confirming the below audit policies are configured on your domain controllers.
You can also have Auditor set the policies for you automatically by utilizing our ‘Adjust audit settings automatically’ option within the ‘edit data source’ menu of the monitoring plan.
Our support team is also more than happy to assist you in troubleshooting this issue further. As well as, walking you through the recommended troubleshooting steps.
If you have any further questions, please let me know.
-Thank You
1 Like
Hi Evan, sorry for late reply.
I just opened Netwrix Auditor Audit Configuration Assistant and finished assessment and result is “Current audit settings comply with requirements” so I would say that audit policies are configured as they should be. Do you have any other suggestions?
Thanks,
Aleksandar
Hello @aleksandar.m, thank you for the reply and confirming that the audit policies are configured to our recommended settings. At this point I would recommend creating a support ticket so that our support team could troubleshoot this issue with you in greater detail.
A support ticket can be created through our customer portal, or by contacting the support line. I’ve included their contact information below.
Customer Portal
Support Phone Number: 888-638-9749
If you would like, I can also create the ticket for you.
If you have any further questions, please let me know.
-Thank You
1 Like