Re: AD Auditing of user accounts

Hello RC,

Check out the script from Richard, exaclty made for this:
http://www.rlmueller.net/Logon5.htm

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> I am interested in auditing account logon's for a handful of domain
> accounts in our 2008 AD domain. I am familiar with setting up domain
> auditing via GPO but not sure how to accomplish this task:
>
> I want to know when this handful of users login and know their IP
> address. I would also like this event information to be forwarded to a
> single txt file on the network so that I dont have to check the
> eventlog on all the domain controllers.
>
> Thanks in advance.
>

Howdie!

Am 22.06.2010 15:46, schrieb RC:
> i believe the security events 4776 Credential Valadation and 4624
> Logon audit this informatiom along with the IP address. my last step
> is to crawl all of my domain controllers security event logs for a
> handful of users that i want to audit and send that info over to a
> networkshare that is holding my text file.

You have 2008 DCs (only)? Those have the ability to associate an action
with a certain event id occurance. Well, you'd have to 2008 DCs for that
(downlevel servers don't have that option).

I believe you'll have to crawl the event logs of the DCs to get that
info -- Powershell is good at that, if you don't have a script/language
preference yet.

Cheers,
Florian