user logon time tracking

Discussion in 'Server Security' started by Bryce, Nov 3, 2006.

  1. Bryce

    Bryce Guest

    Is 680 the only security event to find out when someone has logged on in the
    morning?

    Is there an automated way to find out when someone has logged on and logged
    off over a 3 week period?

    Windows 2003 Server.

    Thanks.

    Bryce.
     
    Bryce, Nov 3, 2006
    #1
    1. Advertisements

  2. You would need to enable auditing of "logon" events and track usage for
    users in question via the local security logs of the computers they logon
    to. There are third party programs that can help automate event log tracking
    such as SELM that I believe is free to try. When you enable auditing of
    account logon events for DCs it will only show when a user logos onto the
    domain. When you audit logon events on DCs it will show when users/computers
    access a share on the DCs such as sysvol share for GP processing and that
    will generate a ton of events in the security log for the DCs.

    Steve

    http://www.gfi.com/lanselm/ --- SELM
     
    Steven L Umbach, Nov 3, 2006
    #2
    1. Advertisements

  3. Bryce

    Bryce Guest

    Perfect.

    Thanks!


     
    Bryce, Nov 4, 2006
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.