Re: Getting a list of logged on users and hosts

From: Eugene Gershnik (gershnik_at_hotmail.com)
Date: 03/30/04 

Date: Mon, 29 Mar 2004 19:18:41 -0800

Slava M. Usov wrote:
> "Eugene Gershnik" <gershnik@hotmail.com> wrote in message
> news:#m4aSoUFEHA.3404@TK2MSFTNGP10.phx.gbl...
>
> [...]
>
>> Not even logging the fact that user X from host Y had connected? If
>> so I wouldn't install such an application.
>
> Logging is a different story. We're talking about enumerating, not
> about parsing logs.

What is the difference? Apart from the convenience of calling someone else's
EnumBlaBla vs. writing your own I don't see any.

> If you enable auditing, the logon will be logged,
> but without the host name. Host name is external to the concept of
> the logon session.

Not for a network logon session.

>
> [...]
>
>> Screen resolution is of a very limited interest while the host used
>> to connect is vital security information.
>
> Replace screen resolution with some biometric information.

This information is presumably stored in AD (or 3rd party directory) as a
property of the user so theoretically I can always access it.
Host name is an example of transient security related information. There
isn't many examples of something similar. 

--
Eugene

Relevant Pages

  • Re: cant ping or telnet to or from a cat 3550
    ... Logging is enabled but shows nothing at all other than a couple ... Interface FastEthernet0/18, changed state to down ... I am trying to ping from a host on Vlan 9, ... from the switch which also does not work. ...
    (comp.dcom.sys.cisco)
  • NIS with Linux and Sun: Environment
    ... Some difficulties arise related to the different environments ... needed depending on the host from which the user is logging in. ... similar binaries on different platforms could ...
    (linux.redhat.misc)
  • NIS with Linux and Sun: Environment
    ... Some difficulties arise related to the different environments ... needed depending on the host from which the user is logging in. ... similar binaries on different platforms could ...
    (comp.unix.solaris)
  • Re: PIX & access-list
    ... accept https from a specific host, then you wouldn't be putting your ... logging timestamp ... This will send a copy of all messages of priority "notification" or ... You probably only want to use debugging level to a syslog server ...
    (comp.dcom.sys.cisco)
  • Re: Getting a list of logged on users and hosts
    ... >> Not even logging the fact that user X from host Y had connected? ... >> to connect is vital security information. ... > Replace screen resolution with some biometric information. ...
    (microsoft.public.win32.programmer.kernel)