I have installed AD Audit Plus and set my DC's and my file server up for auditing. The audit policies for both in the portal were successfully applied and I have checked the policies vs. the official KB's just to be sure as wel as a reboot of the domain controllers. I set up an alert profile because I want to see when a user, any user, fails to login. The alert I set up is as follows:
Configuration>new alert profile
Category>Local Logon failure for computers
Filter> no filter since I want all users (Also tried a filter with just Domain Admin users)
email notifications> set as I need them. all test notifications work.
I have tested by incorrectly entering a users data but no alerts. Not even a 4625 event ID on the DC's.
If I go to reports>Local Logon-Logoff>Interactive logon failure, i see a few from early morning but nothing else.
Not sure the issue. Any help would be appreciated