Enabling Security Auditing on Windows Home Server

A big part of keeping any computer secure involves keeping an eye on what users do with the computer. For Windows Home Server, this means tracking events such as logon failures (repeated failures might indicate a malicious user trying different passwords) and account changes (where someone changes some aspect of a user account). This type of tracking is called auditing.

Unfortunately, Windows Home Server only implements a small subset of its auditing features, and even those that it does implement aren’t all that useful. For example, Windows Home Server audits logon successes, but not logon failures.