Re: Log-in log-out

There are two logon event policies. In addition to the policy already in place also enable the "Audit logon events" policy, you should then see Events 528. The two policies are:

Audit account logon events
Audit logon events

Audit account logon events will record events 680 and 681.

Audit logon events will record events 528 and 529.

John

Mhaxx wrote:

Click on Start | Run and enter gpedit.msc

Look in:

Local Computer Policy\Computer Configuration\Windows Settings\Security
Settings\Local Policies\Audit Policy\Audit account logon events

When you double click on "Audit account logon events" you will see the
options to set the Success, Failure audits.


Just checked both: success and failure but even if I restart my PC (to
log-in) no 528 event is found! Maybe the problem could be related to the
fact on the 3rd columns of the "Audit account logon events" is written that
the only valid setting is the failure.. and not the success: what do you
think?

Mhaxx


.

Relevant Pages

  • Re: Get list of users who logged into Domain Controller?
    ... need to enable "Audit logon events" I suggest you also enable "audit account ... Both of these should be enabled on the domain controller policy. ... > Networks" was missing from the Network Properties. ...
    (microsoft.public.win2000.security)
  • Re: how to track users session in XP
    ... If XP Pro, Group Policy. ... Set both Audit account logon events & Audit logon events for Success & ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Monitor file system changes
    ... There is AD auditing, and then there's file system and other resource auditing. ... Audit logon events: Security Configuration Editor; ... If both account logon and logon audit policy categories are enabled, logons that use a domain account generate a logon or logoff event on ... ...
    (microsoft.public.windows.server.active_directory)
  • Windows 2003 (IIS6) security question
    ... If you enable auditing for "Audit Logon Events" or "Audit Account ... would be for a high traffic web server getting an essentail DOS attack ...
    (microsoft.public.inetserver.iis.security)
  • Re: monitor logon time
    ... Appears Audit logon events needs to be turned on also. ... The one you mention is ones the local security system authorised. ... Click on Local Policies/Audit Policies, ...
    (microsoft.public.windowsxp.general)
Loading