稽核帳戶登入事件Audit account logon events

適用於Applies to

  • Windows 10Windows 10

決定是否要審核使用者登入或登出其他裝置的每個實例,此裝置用來驗證該帳戶。Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account.

這個安全性設定決定是否要審核使用者登入或登出其他電腦中用來驗證帳戶的每個實例。This security setting determines whether to audit each instance of a user logging on to or logging off from another computer in which this computer is used to validate the account. 當網域使用者帳戶在網網域控制站上經過驗證時,就會產生帳戶登入事件。Account logon events are generated when a domain user account is authenticated on a domain controller. 事件會記錄在網網域控制站的安全性記錄中。The event is logged in the domain controller's security log. 當本機使用者在本機電腦上進行驗證時,就會產生登入事件。Logon events are generated when a local user is authenticated on a local computer. 事件會記錄在本機安全記錄中。The event is logged in the local security log. 不會產生帳戶登出事件。Account logoff events are not generated.

如果您定義此原則設定,您可以指定是否要審核成功、審核失敗,或根本不審核事件種類。If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. 成功審核會在帳戶登入嘗試成功時產生審核專案。Success audits generate an audit entry when an account logon attempt succeeds. 當帳戶登入嘗試失敗時,失敗審核會產生審核專案。Failure audits generate an audit entry when an account logon attempt fails. 若要將此值設定為 [ 無審核],請在此原則設定的 [ 屬性 ] 對話方塊中,選取 [ 定義這些原則設定 ] 核取方塊,然後清除 [ 成功 ] 與 [ 失敗 ] 核取方塊。To set this value to No auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

預設值:成功Default: Success

設定此審核設定Configure this audit setting

您可以在 [電腦 Configuration\Windows Settings\Security Settings\Local Policies\Audit 原則] 下開啟適當的原則,以設定此安全性設定。You can configure this security setting by opening the appropriate policy under Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy.

登入事件Logon events 描述Description
672672 驗證服務 (為) 票證已順利頒發並驗證。An authentication service (AS) ticket was successfully issued and validated.
673673 已授與票證授權服務 (TGS) 票證。A ticket granting service (TGS) ticket was granted.
674674 安全性主體已更新為票證或 TGS 票證。A security principal renewed an AS ticket or TGS ticket.
675675 預驗證失敗。Preauthentication failed. 當使用者輸入不正確的密碼時, (KDC) 金鑰發佈中心產生此事件。This event is generated on a Key Distribution Center (KDC) when a user types in an incorrect password.
676676 驗證票證要求失敗。Authentication ticket request failed. 此事件不會在 Windows XP 或 Windows Server 2003 系列中產生。This event is not generated in Windows XP or in the Windows Server 2003 family.
677677 未授與 TGS 票證。A TGS ticket was not granted. 此事件不會在 Windows XP 或 Windows Server 2003 系列中產生。This event is not generated in Windows XP or in the Windows Server 2003 family.
678678 帳戶已成功對應到網域帳戶。An account was successfully mapped to a domain account.
681681 登入失敗。Logon failure. 已嘗試網域帳戶登入。A domain account logon was attempted. 此事件不會在 Windows XP 或 Windows Server 2003 系列中產生。This event is not generated in Windows XP or in the Windows Server 2003 family.
682682 使用者已重新連線到已中斷連線的終端伺服器會話。A user has reconnected to a disconnected terminal server session.
683683 使用者已中斷終端伺服器會話的連線,而不需要登出。A user disconnected a terminal server session without logging off.

相關主題Related topics