Re: Logon/Logoff Auditing

From: Eric Fitzgerald [MS] (ericf@online.microsoft.com)
Date: 07/23/02 

From: "Eric Fitzgerald [MS]" <ericf@online.microsoft.com>
Date: Mon, 22 Jul 2002 18:15:37 -0700

Logon/Logoff events occur on the machine where the access occurred, e.g. the
workstation in the case of a local interactive logon. Account Logon events
occur on the machine which validated the credentials, e.g. a domain
controller in the case of domain credentials being used. In the case of an
interactive access using a local account both events would occur on the same
machine.

Audit policy on domain controllers is controlled by the Domain Controllers
Security Policy, not the Domain Security Policy.

Eric 

--
Eric Fitzgerald
Program Manager, Windows Auditing and Intrusion Detection
Microsoft Corporation
"TM" <toddm@rahul.net> wrote in message news:eSP83e1LCHA.1120@tkmsftngp10...
> I want to log users logging into their computers.  Under domain security
> policies, I've enabled Audit Account Logon Events and Audit Logon Events
for
> Success and Failure.  I assume it would show up in the security log on the
> domain controller, but nothing.  What am I missing?
>
> What is the difference between Audit Account Logon Events and Audit Logon
> Events?
>
> Is it possible to audit logoff events so I can see how long users are
> connected?
>
> Thanks!
>
>

Relevant Pages

  • Re: Track abnormal restart
    ... Set both Audit account logon events & Audit logon events for Success & ...
    (microsoft.public.windowsxp.general)
  • Re: how to track users session in XP
    ... If XP Pro, Group Policy. ... Set both Audit account logon events & Audit logon events for Success & ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Can you find when someone logs in?
    ... Windows only tracks your logins if you specifically configure it to "Audit ... Set the "Audit account logon events" policy ... BTW, I have FULL Admin rights to this workstation, if that helps. ...
    (microsoft.public.windows.server.general)
  • Re: Monitoring Security
    ... Enable auditing of Account logon events for the domain and see where the ... logon failure failure audit is coming from. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Frequent Account Lockouts
    ... but enabling auditing of account logon events on domain ... computers and account logon events on domain controllers may help. ... > workstations, our accounts are very frequently lokcked out ...
    (microsoft.public.win2000.security)
Quantcast