Logon/Logoff notification 1

[ntfsDOTsys]

This question was previously asked here:

http://www.tek-tips.com/viewthread.cfm?qid=735034

The question: Is there a way to get some sort of log or notification of when users on the domain log on and off? Like a nice log with user name and time would be awesome.

Looks like somebody had posted a solution in the closed thread above (

http://www.tek-tips.com/viewthread.cfm?qid=735034)

but the files that were posted (and most of the explaination) was missing because the threads are so old.

Thanks,

Me

A+, Network+, MCP
========================================>
My first computer was the Atari 400 (heh)

 

[itsp1965]

If you enabled auditing of logon events as part of your security policy, you should be able to see events 528 (successful logon), 529 (logon attempt with bad password). 538 (user logged off). Check the MSKB for a further list.

 

[ntfsDOTsys]

Hello and thank you for your reply!

Yes, auditing is turned on but have you ever truly tried to sift through that huge pile of nonsense?

If you read the thread I referenced in my original post you will see there are easier (and better perhaps) alternatives to sifting through the entire security log. A uder in that thread said he had a .bat file and a script to track logon / logoff events.

Even a 3rd party tool to buy would be cool. Anything but the security log.. heh

--me

A+, Network+, MCP
========================================>
My first computer was the Atari 400 (heh)