Windows

• You have windows network and you would like monitor user login / logoff.
• You have already searched the web and usenet trying to find suitable recipies but found none to concise
  • Windows 2003 server came with heaps of new auditing features and many of those are published but silent fact remains, that simple logon / logoff monitoring is not part of default reports.

• FIRST you have to start logon / logoff loging on machines monitored. Those are events 528 (540?) for logon and 538 for logoff.
  • you can start logging of these either locally or via group policy

Audit Logon/Logoff success events. The logon (528/540) and logoff (538

• events by ID at microsoft
• Windows Server 2003 resource kit tools