Re: Logging user Logons

From: Eric Fitzgerald [MS] (ericf@online.microsoft.com)
Date: 07/23/02 

From: "Eric Fitzgerald [MS]" <ericf@online.microsoft.com>
Date: Mon, 22 Jul 2002 18:12:11 -0700

The EventQuery.pl utility in the Windows 2000 Resource Kit is very good at
event filtering, and EventQuery.vbs in Windows XP is even better.

You can't filter user logon events on a per-user basis at the time the
events are logged or with Event Viewer.

Eric 

--
Eric Fitzgerald
Program Manager, Windows Auditing and Intrusion Detection
Microsoft Corporation
"karl x y" <jamescagney90210@excite.com> wrote in message
news:#x4lEqkLCHA.448@tkmsftngp13...
> I don't think this is possible, but you can filter out the entries you
don't
> want, both in the log viewer gui or if you prefer, when you export the log
> entries using the windows 2000 resource kit utility dumpel [possibly
> available for free download from www.microsoft.com/download ] or if you
> choose to spit your windows log out [using I think NTsyslog] to a free
> syslog client such as kiwi syslog service version from
> www.kiwi-enterprises.com
>
> "Allison" <no@email.com> wrote in message
> news:uDJbcldLCHA.1468@tkmsftngp13...
> > I have a Windows 2000 domain with 2 Domain Controllers.  I have logons
> being
> > recorded in the Security portion of Event Viewer on my DCs.
> Unfortunately,
> > it also logs the computer netbios names and the SYSTEM account as well.
> Is
> > there any way for me to have only the usernames logged and filter the
> rest?
> > Or is this even a good idea?
> >
> > Thanks
> >
> > Ally
> >
> >
>
>

Relevant Pages

  • RE: EIF SimpleInstrumentation walkthrough problem
    ... What's the eventthat is produced in the Application event viewer by a ... "Windows Trace Session Manager" is present in the list of started services? ... | description=" A default filter for the Software Element ... | Doesn't seem like the first sample should be this hard. ...
    (microsoft.public.vsnet.enterprise.tools)
  • Re: Search for Text in .asp Files
    ... Ramesh - Microsoft MVP ... Something in Windows keeps changing the text filter back to the html filter. ... asp files 5 levels down which contain that same ...
    (microsoft.public.windowsxp.configuration_manage)
  • Re: Search for Text in .asp Files
    ... Ramesh - Microsoft MVP ... Something in Windows keeps changing the text filter back to the html filter. ... asp files 5 levels down which contain that same ...
    (microsoft.public.windowsxp.general)
  • Re: Search for Text in .asp Files
    ... Ramesh - Microsoft MVP ... Something in Windows keeps changing the text filter back to the html filter. ... asp files 5 levels down which contain that same ...
    (microsoft.public.windowsxp.customize)
  • Re: Help - registering directshow filter in Pocket PC device
    ... Windows CE Multimedia and Graphics ... filter) in Pocket PC device. ... What problem are you having when compiling on CE 5.0? ... HRESULT CSampleGrabber::CheckMediaType ...
    (microsoft.public.pocketpc.developer)