Auslogics Blog

Windows Vista has a lot of great security features. The trouble is that some very useful ones are not turned on by default.

Account auditing is one of them. Why is it good to have it turned on? Because with it disabled practically anyone with physical or remote access to your computer can attempt breaking into your user account for as long as they like. And you wouldn’t even know about it until it’s too late, because audit security policy is not configured to log any account logons, successful or failed, by default. So a hacker will be able to keep trying until he’s successful.

Turning on account auditing is very important – it will let you see who may be trying to break into your account.

To turn on auditing for failed logon events do the following:

1. Go to Start and type secpol.msc, then hit Enter
2. Navigate through Local Policies and Audit Policy
3. Right-click on Audit account logon events policy and go to Properties
4. Check the Failure box and click OK
5. Right-click on Audit logon events policy and go to Properties
6. Check the Failure box and click OK
7. Close Local Security Policy editor

From now on your computer will log all failed logon attempts. You will be able to view these logs in Event Viewer (run eventvwr.msc) under Windows Logs and Security.