HP StorageWorks X5000 Technical Manual page 21

Member Server Default
Success
The Audit logon events setting determines whether to audit each instance of a user logging on to or
off of a computer. Records are generated from the Account logon events setting on domain controllers
to monitor domain account activity and on local computers to monitor local account activity.
Configuring the Audit logon events setting to No auditing makes it difficult or impossible to determine
which user has either logged on or attempted to log on to computers in the enterprise. Enabling the
Success value for the Auditing logon events setting on a domain member will generate an event
each time that someone logs on to the system regardless of where the accounts reside on the system.
If the user logs on to a local account, and the Audit account logon events setting is Enabled, the user
logon will generate two events. There will be no audit record evidence available for analysis after a
security incident takes place if the values for this setting are not configured to Success and Failure for
all three security environments defined in this guide.
Event ID Audit Logon Events
528 A user successfully logged on to a computer.
529 Logon failure. A logon attempt was made with an unknown user name or a known user
name with a bad password.
530 Logon failure. A logon attempt was made outside the allowed time.
531 Logon failure. A logon attempt was made using a disabled account.
532 Logon failure. A logon attempt was made using an expired account.
533 Logon failure. A logon attempt was made by a user who is not allowed to log on at the
specified computer.
534 Logon failure. The user attempted to log on with a password type that is not allowed.
535 Logon failure. The password for the specified account has expired.
536 Logon failure. The Net Logon service is not active.
537 Logon failure. The logon attempt failed for other reasons.
Note: In some cases, the reason for the logon failure may not be known.
538 The logoff process was completed for a user.
539 Logon failure. The account was locked out at the time the logon attempt was made.
540 A user successfully logged on to a network.
541 Main mode Internet Key Exchange (IKE) authentication was completed between the local
computer and the listed peer identity (establishing a security association), or quick mode
has established a data channel.
542 A data channel was terminated.
543 Main mode was terminated.
Note: This might occur as a result of the time limit on the security association expiring (the
default is eight hours), policy changes, or peer termination.
544 Main mode authentication failed because the peer did not provide a valid certificate or
the signature was not validated.
Audit Logon Events
Legacy Client
Success Failure
21
Enterprise Client
Success Failure
High Security Client
Success Failure