RE: Real time log in monitoring - best practices
- From: v-crinal@xxxxxxxxxxxxxxxxxxxx ("Crina Li")
- Date: Fri, 01 Sep 2006 07:53:43 GMT
Hi TC,
Thanks for your update.
As I know, you can enable Audit log in Event log to do so. I provide the
detailed steps on SBS for your reference:
1. Click Start, click Run, type "gpmc.msc" and click OK.
2. Expand Domains -> your domain -> Domain Controllers.
3. Right-click Small Business Server Auditing Policy and click Edit.
4. Expand Computer Configuration -> Windows Settings -> Security Settings
-> Local Policies -> Audit Policy.
5. Configure Audit account logon events and Audit logon events.
More information:
174073 Auditing User Authentication
http://support.microsoft.com/?id=174073
Using Audit Policies to Secure Your Windows 2000 Network
http://whidbey.msdn.microsoft.com/library/default.asp?url=/library/en-us/dne
xnt00/html/ewn0054.asp
Securing Your Windows Small Business Server 2003 Network
http://www.microsoft.com/downloads/details.aspx?familyid=f62b2722-267c-4642-
b287-c31115ef10a4&displaylang=en
Thanks for your time and I look forward to hearing from you.
Best regards,
Crina Li (MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: Real time log in monitoring - best practices
| thread-index: AcbNGkn7lfhj1L2VRBeXTYzxW9Nugg==
| X-WBNR-Posting-Host: 70.103.93.170
| From: =?Utf-8?B?VEM=?= <TC@xxxxxxxxxxxxxxxxxxxxxxxxx>
| References: <38BB3819-0566-432F-8464-2832072CCF2A@xxxxxxxxxxxxx>
<KSoln5LzGHA.4464@xxxxxxxxxxxxxxxxxxxxx>
| Subject: RE: Real time log in monitoring - best practices
| Date: Thu, 31 Aug 2006 09:27:02 -0700
| Lines: 134
| Message-ID: <00841D1D-7E71-4A32-91CF-30614D820C9E@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGXA01.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:294428
| NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hello Crina,
|
| Well the reports are a good start however I was looking for a method or
| application that will show the login attempts as they are happening.
|
| TC
|
| ""Crina Li"" wrote:
|
| > Hi TC,
| >
| > Thank you for posting in SBS newsgroup.
| >
| > From you post, I understand that you want to view remote Connection
| > information in server usage report. If I have misunderstood your
concerns,
| > please do not hesitate to let me know.
| >
| > Actually there are two kinds of Usage report: Basic Usage Report and
| > Extended Usage Report. Remote Connection Activity in server Extended
usage
| > report lists remote access by VPN and modem dial in.
| >
| > As I know, Server Usage Report contains the following information:
| >
| > Web Activity by Computer
| > Web Traffic by Hour
| > E-mail sent
| > E-mail received
| > Mailbox size
| > Outlook Web Access Activity by User
| > Outlook Web Access Usage by Hour
| > Remote Connection Activity by User
| > Remote Connection Activity by Hour
| > Faxes Sent
| > Faxes Received
| > Faxes Sent by User
| > Fax Traffic by Hour
| >
| > You can click Create New Report and then select the extended usage
report.
| >
| > In RRAS log, you can also find the information of remote access.
| >
| > The following articles should help:
| >
| > 834120 TechNet Support WebCast: Monitoring features in Microsoft
Windows
| > Small Business Server 2003
| > http://support.microsoft.com/?id=834120
| >
http://support.microsoft.com/?scid=http://support.microsoft.com%2Fservicedes
| > ks%2Fwebcasts%2Fen%2Ftranscripts%2Fwct011504.asp
| >
| > Monitoring Your Server
| >
http://download.microsoft.com/download/f/b/a/fba7f737-bdd3-4570-8873-43cab9c
| > 6e1db/sbs_bp.htm#monitoring
| >
| > I appreciate your time and look forward to hearing from you.
| >
| > Best regards,
| >
| > Crina Li (MSFT)
| >
| > Microsoft CSS Online Newsgroup Support
| >
| > Get Secure! - www.microsoft.com/security
| >
| > =====================================================
| > This newsgroup only focuses on SBS technical issues. If you have issues
| > regarding other Microsoft products, you'd better post in the
corresponding
| > newsgroups so that they can be resolved in an efficient and timely
manner.
| > You can locate the newsgroup here:
| > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| >
| > When opening a new thread via the web interface, we recommend you check
the
| > "Notify me of replies" box to receive e-mail notifications when there
are
| > any updates in your thread. When responding to posts via your
newsreader,
| > please "Reply to Group" so that others may learn and benefit from your
| > issue.
| >
| > Microsoft engineers can only focus on one issue per thread. Although we
| > provide other information for your reference, we recommend you post
| > different incidents in different threads to keep the thread clean. In
doing
| > so, it will ensure your issues are resolved in a timely manner.
| >
| > For urgent issues, you may want to contact Microsoft CSS directly.
Please
| > check http://support.microsoft.com for regional support phone numbers.
| >
| > Any input or comments in this thread are highly appreciated.
| >
| > =====================================================
| >
| > This posting is provided "AS IS" with no warranties, and confers no
rights.
| > --------------------
| > | Thread-Topic: Real time log in monitoring - best practices
| > | thread-index: AcbMcc/20e4SP5D1Rd+JXtY+DbEq5Q==
| > | X-WBNR-Posting-Host: 70.103.93.172
| > | From: =?Utf-8?B?VEM=?= <TC@xxxxxxxxxxxxxxxxxxxxxxxxx>
| > | Subject: Real time log in monitoring - best practices
| > | Date: Wed, 30 Aug 2006 13:21:01 -0700
| > | Lines: 17
| > | Message-ID: <38BB3819-0566-432F-8464-2832072CCF2A@xxxxxxxxxxxxx>
| > | MIME-Version: 1.0
| > | Content-Type: text/plain;
| > | charset="Utf-8"
| > | Content-Transfer-Encoding: 7bit
| > | X-Newsreader: Microsoft CDO for Windows 2000
| > | Content-Class: urn:content-classes:message
| > | Importance: normal
| > | Priority: normal
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
| > | Newsgroups: microsoft.public.windows.server.sbs
| > | Path: TK2MSFTNGXA01.phx.gbl
| > | Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:294225
| > | NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
| > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > |
| > | Hi,
| > |
| > | What's a good way overall to see what's happening real time when
users
| > | attempt to log on? Especially remote users.
| > |
| > | I'm having problems with OMA users/devices, in this case a Treo 650
| > | (Cingular) browsing to ourExchange/oma. User get's the login prompt
and
| > then
| > | gets denied.
| > |
| > | Platform is a new install of sbs2003 but we had to migrate some sick
| > | mailboxes and profiles from the old sbs server.
| > | OWA logins aren't entirely consistent either with all users.
| > |
| > | Thanks for help!
| > |
| > | TC
| > |
| > |
| >
| >
|
.
- Follow-Ups:
- Re: Real time log in monitoring - best practices
- From: b4ucmellcu
- Re: Real time log in monitoring - best practices
- Prev by Date: Tapeware backup problem on 2003SBS
- Next by Date: RE: ISA timing out outbound TermServ Session?
- Previous by thread: Tapeware backup problem on 2003SBS
- Next by thread: Re: Real time log in monitoring - best practices
- Index(es):
Relevant Pages
|
Loading
