How do I monitor failed logon attempts in Windows?

Question

Is there any reliable way to monitor failed logon attempts on-the-fly in Windows XP? (well, Vista too for that matter). I need to monitor failed logon attempts programmatically which is currently accomplished with a simple GINA Stub by subclassing the Login dialog from MSGINA.

However, my current solution is not waterproof if there are other GINAs in the chain.

So my question is: Is there any (other) API I can rely on? Or do I have to roll out an entire GINA replacement DLL?

Answer 1

I would look at the Windows Event Log - the Security or System Log should have these events.

You can monitor the event log either manually with the Event Viewer administrative tool, or programmatically.