How can I tracking computer usage? (login/logout times)

[wlfpackr]

I need to track computer usage for an employee that is possibly fudging on his time card. If I view the security logs I can see when an employee logs on to the computer and when he initiates the logging off process. However, this won't give a reliable report since the user may not always log off at the end of the day.

I'm wondering if there is something for the Windows screen saver lock out that I could also track? Company-wide the screensaver is scheduled to lock out after 30mins. While still not 100% accurate, this would get us pretty close.

It looks like there is a process called KSecDD that is logged in the security logs when the screen saver lockout runs, however, I've been unable to find a definitive answer that this is what the process is for.

I'm also open to any other suggestions, but I'm not going down the route of installing 3rd party applications.

=================
There are 10 kinds of people in this world, those that understand binary and those that do not.

 

[dseaver]

You could write/find some software that watches his CPU usage. That way you can tell when he is actually working

 

[linney]

StatWin software is designed to collect, store and analyze the statistics of computer operation and user activities under Windows

http://www.sxrsoft.com/

Ksecdd.
"Ksecdd is a very thin component that NTFS calls to communicate with the LSA. Ksecdd is used to set up local procedure call (LPC) communications to the LSA".



"The NTFS driver contains the majority of the EFS code in the kernel. This driver responds to file system controls (FSCTLs) from the LSA to encrypt or decrypt a file. When a file is opened, the driver passes the wrapped FEK to Ksecdd to be unwrapped by the LSA. The driver then decrypts the data when it is read from the file and encrypts the data when it is written to the file".

http://technet2.microsoft.com/windo...73ec-4041-9cf4-1370739a59201033.mspx?mfr=true