Re: Security/Login/Logoff Logs

From: Jack Ryan (puickj@hotmail.com)
Date: 02/06/03 

From: "Jack Ryan" <puickj@hotmail.com>
Date: Wed, 5 Feb 2003 18:49:31 -0800

Thanks for the Util tip. But how can an ordinary user who
login once in the morning and logouts at night have, 10
entries of 540 and 528?

Thanks again.

>-----Original Message-----
>Also try the DUMPEL utility from the Resource Kit, for
better filtering:
>
>DUMPEL -l security -m security -e 528 540 -c
>
>You can use findstr to filter the output, for instance:
>
>DUMPEL -l security -m security -e 528 540 -c |
findstr "COMPUTERNAME"
>
>Eric
>
>--
>Eric Fitzgerald
>Program Manager, Windows Auditing and Intrusion Detection
>Microsoft Corporation
>
>This posting is provided "AS IS" with no warranties, and
confers no rights.
>
>"Eric Fitzgerald [MSFT]" <ericf@online.microsoft.com>
wrote in message
>news:3e41936a$1@news.microsoft.com...
>> You should only enable the "Logon/Logoff" audit
category, and for
>"success"
>> audits only.
>>
>> Eric
>>
>> --
>> Eric Fitzgerald
>> Program Manager, Windows Auditing and Intrusion
Detection
>> Microsoft Corporation
>>
>> This posting is provided "AS IS" with no warranties,
and confers no
>rights.
>>
>> "jack ryan" <puickj@hotmail.com> wrote in message
>> news:0b5701c2ccb9$1f8dfbd0$89f82ecf@TK2MSFTNGXA01...
>> > How do I log ONLY user logins/logoffs (IE, when they
login
>> > to the network using username password). Auditing
>> > collects a lot of these information, but very
ambiguous.
>> > The filtering doesn't work well either. There is a
>> > program I used before, it is called LastLogon, but
that
>> > just display the last login time.
>> >
>> > Thanks inadv.
>> >
>> >
>>
>>
>
>
>.
>

Relevant Pages

  • Security/Login/Logoff Logs.
    ... when user only login once and logoff once? ... Does the audit pick up a logon everytime a computer makes ... Windows Auditing and Intrusion Detection ... >> Eric Fitzgerald ...
    (microsoft.public.win2000.security)
  • Re: OLAP Log
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... >> Cube) and what cube does user access. ... >> I need the username, login date, login time, login OLAP cube and logout ... >>> Program Manager ...
    (microsoft.public.sqlserver.olap)