Re: Track when users login

From: Harini Raghavan \(MSFT\) (harinir_at_online.microsoft.com)
Date: 05/30/03

  • Next message: Harini Raghavan \(MSFT\): "Re: Remote viewing event log." 
    Date: Thu, 29 May 2003 18:28:32 -0700

    You should enable account logon audit in the default domain policy
    This will ensure auditing of logon events when clients login from a
    machine joined to a domain
    And as long as the setting in default domain controller (DDC) doesnt
    override you will
    get the audits (you can leave it undefined in the DDC) 

    --
This posting is provided "AS IS" with no warranties, and confers no rights.
Any opinions or policies stated within are my own and do not necessarily
constitute those of my employer. Use of included script samples are subject
to the terms
specified at http://www.microsoft.com/info/cpyright.htm
"Greg Kelley" <gkelley@remove-me-before-replying-ssgtechnology.com> wrote in
message news:eJjxNSjJDHA.2244@TK2MSFTNGP10.phx.gbl...
> Windows 2000 domain mixed mode with multiple DCs...
> I need to be able to track when a user logs into the domain.  Namely for
the
> purpose of combating "well, I got to work at 8:00", "yeah, but it shows
you
> didn't log in to the domain until 9, why?"
> I'm assuming I do this with Group Policies.  I managed to track when a
user
> logs onto the console of a DC by setting up auditing of Active Directory
> Access in the Default Domain Controller policy, but I don't want to
monitor
> when they log onto the console of a DC, but rather log into the domain
> itself from any computer.
>
>
>
  • Next message: Harini Raghavan \(MSFT\): "Re: Remote viewing event log."

    Relevant Pages

    • Re: Accounts Being Locked Out?
      ... I have it set for my local policy but it says the ... Domain policy is overriding it to no auditing. ...
      (microsoft.public.security)
    • Auditing file deletions only
      ... Recently I wanted to start auditing when certain folders ... Enabled success/failure on the domain policy ...
      (microsoft.public.win2000.security)
    • Re: Account management events audit !!
      ... I applied the audit to default domain policy -I created ... Controllers OU (Only domain ... Put the auditing on an OU that contains ... confers no rights. ...
      (microsoft.public.win2000.active_directory)
    • Re: Domain Password Policy
      ... but you may want to consider some auditing to ... We have it set at 230 days and it gets reset to 150. ... > of our DCs did not have the right setting and replicating this change. ... > I checked the domain policy on all of the DC and they are all set to 230. ...
      (microsoft.public.windows.server.active_directory)
    • Re: IP address
      ... > and having a blast:D ... I think he means that the system would not allow auditing. ... weren't able to do labs with auditing because the domain policy would not ...
      (microsoft.public.cert.exam.mcsa)