Re: Track user behaviour through event log

From: RCC (rcc76@hotmail.com)
Date: 05/31/02


From: "RCC" <rcc76@hotmail.com>
Date: Sat, 1 Jun 2002 09:06:14 +1200


"Søren Maigaard" <spam@maigaard.com> wrote in message
news:#f25zvJCCHA.1576@tkmsftngp04...
> Is there a program that can track user behaviour through the event log?
> That is, see which files she opens, when and how many, how many times she
> tries to log on and at what hours - and then create a profile for that
user
> over time. If she then does something outside of this profile (for
instance
> tries to access different files than she usually does and at 3 o'lock at
> night) it would alert the administrator. Is that possible?
>
> TIA,
>
> - Søren
>

Last time I enquired about this I was told to go ask the University students
if they want a project...
:(
That will be the mother of IDS.
If you find anything, I'd appreciate if you let me know.
Otherwise I'll be starting on the project myself next year.
Regards,
RCC



Relevant Pages

  • Track user behaviour through event log
    ... Is there a program that can track user behaviour through the event log? ... That is, see which files she opens, when and how many, how many times she ... If she then does something outside of this profile (for instance ...
    (microsoft.public.win2000.security)
  • VC++ Error on My Computer, IEXPORE and Folder Items
    ... get a VC++ Runtime Error with explore.exe. ... Product: Windows Operating System ... Component: Application Event Log ... The profile for user %1 is mandatory. ...
    (microsoft.public.windowsxp.security_admin)
  • New users get temp profiles
    ... Your user profile was not loaded correctly you have ... Also in my event log, ... Windows has backed up this user's profile. ... deleting the user and recreating it has no symptom change ...
    (microsoft.public.windows.server.general)
  • new users get temp profile
    ... Your user profile was not loaded correctly you have ... Also in my event log, ... Windows has backed up this user's profile. ... deleting the user and recreating it has no symptom change ...
    (microsoft.public.windows.terminal_services)
  • Re: New users get temp profiles
    ... Whenever I create any new user on my NT Domain Controller ... Your user profile was not loaded correctly you have ... Also in my event log, ... deleting the user and recreating it has no symptom change ...
    (microsoft.public.windows.server.general)