Windows

From Mesopoly 3.0
Revision as of 13:23, 24 March 2006 by Zlatko (talk | contribs)
Jump to navigation Jump to search
  • You have windows network and you would like monitor user login / logoff.
  • You have already searched the web and usenet trying to find suitable recipies but found none to concise
    • Windows 2003 server came with heaps of new auditing features and many of those are published but silent fact remains, that simple logon / logoff monitoring is not part of default reports.
    • your network may not be win2003 network at all. you may entertain win2000 or even serverless network.
  • FIRST you have to start logon / logoff loging on machines monitored. Those are events 528 for logon and 538 for logoff. More on microsoft Event ID
    • Take care you dont confuse these with 'account logon' events which are something else and have different IDs
    • you can start logging of these either locally or via group policy.Audit Logon/Logoff success events.



  • Download Windows Server 2003 resource kit tools. Dont worry you can run them on WinXP. Tool you are interested in is Event Comber. There is such download for Windows 2000 also, I am yet to find it again on microsoft site.
Retrieved from "https://vinodol.com/moki/index.php?title=Windows&oldid=1839"