Wednesday, June 17, 2009

How to track users logon/logoff

The Auditing


Option 1:

1. Enable Auditing on the domain level by using Group Policy:

Computer Configuration/Windows Settings/Security Settings/Local Policies/Audit Policy

There are two types of auditing that address logging on, they are Audit Logon Events and Audit Account Logon Events.

Audit "logon events" records logons on the PC(s) targeted by the policy and the results appear in the Security Log on that PC(s).

Audit "Account Logon" Events tracks logons to the domain, and the results appear in the Security Log on domain controllers only


2. Create a logon script on the required domain/OU/user account with the following content:

echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver% >>
\\SERVER\SHARENAME$\LOGON.LOG

3. Create a logoff script on the required domain/OU/user account with the following content:

echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver% >>
\\SERVER\SHARENAME$\LOGOFF.LOG


Note: Please be aware that unauthorized users can change this scripts, due the requirement that

the SHARENAME$ will be writeable by users.


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Option 2:


Use WMI/ADSI to query each domain controller for logon/logoff events.

Share this

1 Response to "How to track users logon/logoff"

  1. Hi there colleagues, how is the whole thing,
    and what you want to say regarding this paragraph, in my view its genuinely amazing in favor of
    me.

    Here is my blog: saidposts3.insanejournal.com/952.html

    ReplyDelete