Re: Auditing a User

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 01/17/05 

Date: Mon, 17 Jan 2005 13:39:24 -0600

To track everything you would need a keyboard logger but I would NOT do that
without consulting legal and personnel first. Other than that you can use
the built in auditing on a W2K computer though it will record Events for all
users on the computer unless you enable auditing of object access and then
audit folders/files for permissions for that user. If you do such be sure to
audit only for that user and only for exactly what you want to track. If you
try to audit the while system you will have gazillions of 560/562 object
access events recorded in the security log which you will want to increase
substantially from default if you enable folder/file auditing. The links
below should help. Internet access can often be tracked in the firewall logs
by computer IP source address to ports 80/443 outbound for instance. For
most reliability the computer you want to track should have a static IP
address. --- Steve

http://www.comptechdoc.org/os/windows/win2k/win2kauditing.html
http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://www.microsoft.com/technet/security/guidance/secmod128.mspx

"Dan" <anonymous@discussions.microsoft.com> wrote in message
news:%23I3TO8L$EHA.3988@TK2MSFTNGP11.phx.gbl...
> Is there a way to track a users activity. I want to track everything a
> user
> does on his pc. Im on a windows 2k Network. I only want to track this
> certain user not the entire domain.
>
>

Relevant Pages

  • Re: Auditing a User
    ... users on the computer unless you enable auditing of object access and then ... audit only for that user and only for exactly what you want to track. ... access events recorded in the security log which you will want to increase ... substantially from default if you enable folder/file auditing. ...
    (microsoft.public.win2000.security)
  • Re: Auditing a User
    ... users on the computer unless you enable auditing of object access and then ... audit only for that user and only for exactly what you want to track. ... access events recorded in the security log which you will want to increase ... substantially from default if you enable folder/file auditing. ...
    (microsoft.public.win2000.general)
  • Re: DC Policy: just want to audit files, not set security
    ... definition to deliver only Audit SACL to some storage ... > to audit everything. ... Just enabling auditing of object access will generate ... > lot of events in the security log. ...
    (microsoft.public.windows.server.security)
  • Auditing on a member server
    ... We have auditing set at AD to audit certain failures and success events, ... at a local server we cant get the auditing to log to security log any ... Our audit policy allows the security log to get up to 16 meg and it is ...
    (microsoft.public.windows.server.security)
  • Re: File Auditing
    ... The nature of auditing of object access is that there will be many seemingly ... but instead create a global group or local groups of users you want to audit. ... avoid auditing write or you will continue to large amounts in the security log. ...
    (microsoft.public.win2000.security)