All,

I have installed AD Audit Plus and set my DC's and my file server up for auditing. The audit policies for both in the portal were successfully applied and I have checked the policies vs. the official KB's just to be sure as wel as a reboot of the domain controllers. I set up an alert profile because I want to see when a user, any user, fails to login. The alert I set up is as follows:

Configuration>new alert profile

Category>Local Logon failure for computers

Filter> no filter since I want all users (Also tried a filter with just Domain Admin users)

email notifications> set as I need them. all test notifications work.

I have tested by incorrectly entering a users data but no alerts. Not even a 4625 event ID on the DC's.

If I go to reports>Local Logon-Logoff>Interactive logon failure, i see a few from early morning but nothing else.

Not sure the issue. Any help would be appreciated