Re: Logon/off tracking

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 08/13/04 

Date: Fri, 13 Aug 2004 17:59:07 +0200

anonymous@discussions.microsoft.com wrote:

> I have setup a local security policy on a win 2003 dc to
> audit for "Successful Attempts" and have noticed that
> when I check the Security tab in event viewer it shows
> event id's 540 (Successful logon) and 538 (Successful
> logoff)minutes apart for users when they have been logged
> on for hours......I would expect to see an event when
> they successfully logon anf then another when they log
> off...what I see is continous logons and logoffs minutes
> apart throughout the day.
>
> Am I missing something here?
Hi

You could build your own logon/logoff tracking using logon/logoff
scripts, more here:

http://groups.google.com/groups?selm=%23fbVFNtuDHA.3116%40tk2msftngp13.phx.gbl

There are tools out there that can help you (with an agent installed
on every computer), I think the two products below should be able to
give you the information you want:

UserLock
http://www.softwareshelf.com/products/display.asp?p=42

Microsoft's solution:
You could install the CCONNECT Microsoft Resource Kit utility onto
every computer, it is in the Win2k Server Resource Kit, Supplement 1
(pay ware, and you will need a SQL server database as well).

More about CCONNECT here:
http://groups.google.com/groups?selm=3F5CE888.8A3EE8D3%40hydro.com 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: Preventing Multiple Logons with same username/password
    ... You could install the CCONNECT Microsoft Resource Kit utility onto every ... Microsoft MVP Scripting and WMI, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Concurrent user login
    ... You could install the CCONNECT Microsoft Resource Kit utility onto every ... Microsoft MVP Scripting and WMI, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Monitor Log off time and on time
    ... You could install the CCONNECT Microsoft Resource Kit utility onto every ... Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windows.server.general)
  • Re: Who is currently logged into domain(s)
    ... You could install the CCONNECT Microsoft Resource Kit utility onto ... every computer, it is in the Win2k Server Resource Kit, Supplement 1 ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.scripting.wsh)
  • Re: Log in and log off reports
    ... You could install the CCONNECT Microsoft Resource Kit utility onto ... every computer, it is in the Win2k Server Resource Kit, Supplement 1 ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windowsxp.security_admin)
Loading