I need help auditing internet usage of a user

[ScreeminChikin]

I need to audit how much time a particular user is spending surfing the web as well as where so I can diferentiate between business and pleasure. I dont have a clue where to start and cant find anything on Technet that points me in the right direction. I dont have any kind of auditing set up right now because I havn't had a need up until now.

Thanks
-Mike

 

[david902]

most failry decent firewalls have logging

i.e to track data throughput from a source IP address,

this would be a good place to start.

 

[ScreeminChikin]

I have a 3com hardvare firewall/VPN appliance that does have some logging but wont do what I want. I just want to track one particular domain user account. I figured I could just set up an audit but cant find anything about web access auditing.

 

[butchrecon]

I dont think there is anything built into Windows 2000 that will do that. You will have to purchase a third party program or software like MS ISA 2000 Server to do what you want to do. James Collins
Hardware Engineer
A+ Certified Professional
Network+ Certified Professional
Microsoft Certified Professional

 

[BuzzHog]

Try eBlaster...

http://www.net-loans.net/spector/protection.someones/investigative.asp

Hope it helps...

 

[DJSpinja]

A brute force method that would probably accomplish your goal is to install a remote desktop sharing client on the machine you want to audit. Anytime you want to see if the user is browsing for business or pleaure, all you have to do is log on and you will be able to literally see what the user is looking at. Looking through the browser history on the user's machine will also give you an idea of the type of sites the user is visiting.

Hope this helps

Aldwin

 

[ScreeminChikin]

The user is smart enough to clear out the browser history, delete cookies etc. And he knows that he is being watched. We actually own Spectre Pro and he knows it. Its also a little too "Big Brother" for my taste. I dont want to read the guys mail or anything, and even in stealth mode a savvy user can detect it. There are also legal issues that I don't want to adress there. I also dont want to spend all day watching screenshots of what he is doing. I just want a basic log that shows a list of websites and times that the user cant clear out. I figured there was no way he would pick up on an audit, and I thought it was built into Win2k server.

 

[g8orade]

I would suggest putting a hub...not switch....between him and the port that he is connected to....then put the monitoring software on a laptop connected to the same hub that he is connected to. There are several monitoring packages that would allow you to do this on a trial basis. This site has a trial version that you can try.

http://www.network-monitor.com/

. .I didnt read much but you may be able to monitor without using a hub.

 

[sgscit]

Try software like WebMarshal or SurfControl. With either of these programs you can set them to log user, time, destination IP, destination DNS name etc. You can then simply run a report as they log to SQL Server.

http://www.marshal.com

http://www.surfcontrol.com

You can with these packages specify the user and time and date in the report you want to run.

Not cheap, but rather handy.

Cheers,

Peter Barras
Southern Grampians Shire Council
Australia

 

[Lizardkng]

Or use group policy and content advisor.

 

[ScreeminChikin]

Can you elaborate on content advisor and how it works? Sounds like were on the right track.

 

[jaeddy]

One issue that no one here has mentioned: from a legal standpoint, unless you have hard evidence that this user is violating your policies auditing only his/her usage will avail you very little. We ran in to a similar issue about a year ago and I pushed to monitor ALL usage. This didn't sit well with some folks, but when HR got involved it turned out to be crucial. Note that this was NOT a situation where we were loooking to dismiss an employee- the monitoring resulted in a note to simply "knock it off.' The point was that by having multiple records we were able to show that the user's surfing activities were far in excess of the norm, AND that he had not been singled out for "special attention."

Just my 2 cents.