Re: Need logon and Logoff data for 30 days

From: Steven L Umbach (
Date: 09/15/05

Date: Wed, 14 Sep 2005 17:47:06 -0500

Auditing of account logon events alone will not show when a user logs off.
You would need to enable auditing of logon events [or just use logon events
on those servers] on your domain Citrix servers that the users are logging
onto to see logoffs also. Anyhow on your domain controllers and domain
servers where you want to track user activity you will need to substantially
increase the size of the security logs starting with maybe 50MB and disable
any auditing that you do not currently use that may be enabled such as
object access [used for folder auditing], process tracking, and privilege
use. You can also use the free MS tool Event Comb to make it easier to find
specific events in security logs on multiple computers which can include
text strings for user name, etc. --- Steve;en-us;308471 --- info on
Event Comb.

"Shay" <> wrote in message
> Hi, I have about 600 remote users that logon through 10 Citrix servers.
> Upon
> request, I need to be able to provide when a perticular user logged on and
> off for the last 30 days. I curently have set our default domain policy to
> "audit account logon events" but it is logging a ton of stuff and
> constantly
> fills our security log before 30 days is up. Anyway, any suggestions would
> be
> greatly appreciated.
> 2003 AD
> TIA,
> Shay

Relevant Pages

  • Re: Remote Desktop auditing
    ... XP Pro has the same auditing capabilities as Windows 2003 Server other than ... You would want to enable auditing of ... account logon events and maybe logon events in Local Security Policy. ...
  • Re: auditing file writes
    ... enable auditing of object acess, ... > 562 by user SYSTEM a lot. ... > SYSTEM it fills up my logs with usless info. ...
  • Re: users logon and Logoff Auditing
    ... You will need to enable auditing of logon events on their computers and then ... monitor that when user logs on and logs off and how long he/she remains. ...
  • Re: Monitor User log-ons
    ... First of all, auditing is per machine basis, you need to enable auditing on ... Audit account logon events - to audit logon thru domain ...
  • IM looking for software to analyze event log
    ... some software that can alalyze security event logs, i am auditing ... account log on event ... The logs are so longs and you have to go into each log to view who it was ...