Enable the windows event viewer to log kerberos authentication attempts
This task enables the Windows Event Viewer to log successful and unsuccessful Kerberos authentication attempts so that the passive identity agent can function properly by reading user sessions from the Event Viewer.
The passive identity agent reads user sessions from the Event Viewer so this setting is required for the passive identity agent to function properly.
For more information, see System audit policy recommendations on learn.microsoft.com.
Procedure
Step 1 | Log in to the Active Directory Server as an administrator and open a DOS command prompt. |
Step 2 | Enter gpmc.msc to start the Group Policy Management Editor. |
Step 3 | If necessary, create a new Group Policy Object (GPO); if one already exists, edit it. For more information about creating a GPO, see a resource like Create a Group Policy Object on learn.microsoft.com. |
Step 4 | In your GPO, expand . |
Step 5 | Click Account Logon. |
Step 6 | In the right pane, double-click Audit Kerberos Authentication Service. |
Step 7 | In the dialog box that is displayed, select all checkboxes which enables the system to log successes and failures. The following figure shows an example.
|
Step 8 | Follow the prompts on your screen to save the changes. |
Step 9 | (Optional.) To update GPO immediately, enter gpupdate /force in your DOS command prompt window. |
