Re: Log system shutdown

From: Allen Harkleroad - Microsoft MVP (allenharkleroad@spamcop.net)
Date: 09/11/02 

From: "Allen Harkleroad - Microsoft MVP" <allenharkleroad@spamcop.net>
Date: Wed, 11 Sep 2002 07:14:51 -0400

Audit account login events in local security settings should show logon and
log off (set it to success and failure), you may also need to audit system
events and audit logon events 

--
Allen Harkleroad
Microsoft MVP
1996 to present
"please keep replies in the newsgroup
so others can benefit, email requests will
be ignored"
Spammers can send email to:
blockme@relays.osirusoft.com
(if you want to be added to the black list)
"Paul Bauer" <bauepe@rimrockgroup.com> wrote in message
news:ez#Sg1OWCHA.2476@tkmsftngp09...
Is there a setting, by group policy or otherwise, to log which user shut
down a machine? Thanks.
Paul Bauer
paul.bauer@rimrockgroup.com

Relevant Pages

  • Re: Benutzerkonten oft gesperrt !!!
    ... Wie heißt auf deutsch "account logon events" und "logon events"? ... Configuring Audit Policy ... you don't use User Manager to enable auditing in Win2K. ...
    (microsoft.public.de.german.win2000.active_directory)
  • RE: find on which computer is connected a user
    ... i dones'nt want if possible to enable Audit Logon Events ... You may try to enable the policy "Audit Logon Events" and then audit the ... Limit concurrent connections per user. ...
    (microsoft.public.windows.server.general)
  • RE: find on which computer is connected a user
    ... You may try to enable the policy "Audit Logon Events" and then audit the ... Write events to the event log of a specified server concerning the status ...
    (microsoft.public.windows.server.general)
  • Re: Event viewer- security log
    ... If you configure an audit policy to audit successful logon and logoff ... Successful Network Logon ... I looked at it and it look like it is recording everybody ...
    (microsoft.public.windowsxp.security_admin)
  • RE: how can I see when the last time it was when a computer loged on
    ... You can try to enable the policy "Audit logon events" and then we can audit ... Events->Select Success and Failure. ...
    (microsoft.public.windows.server.sbs)