Logon Auditing

From: Ross (rossd_at_musicradio.com)
Date: 07/30/03 

Date: 30 Jul 2003 13:52:02 -0700

Hi guys

I wonder if you can help me with something.

I am trying implement centralised archvival of remote event logs via a
perl script I have written. It works quite well and I can retrieve
the information I want on a regular time period. The problem I have
is that every time I connect to a remote server to retrieve logs
(which can be every 10 minutes) I get the usual logon/logoff/kerberos
messages in the remote security log. The upshot being that it takes
longer and longer to retrieve the security logs because the program is
generating so much "noise".

I'm not sure if this is the route I want to take, but I was wondering
if it is possible stop logon/logoff auditing(or indeed any auditing)
for just the one account that is running the script and leave it
enabled for all others?

Any suggestions/hints much appreciated.

Regards

Ross

PS - Apologies for the repost, but for some reason this ended up on
the bottom of someone elses thread.

Relevant Pages

  • User Logon/Logoff Auditing
    ... perl script I have written. ... It works quite well and I can retrieve ... is that every time I connect to a remote server to retrieve logs ...
    (microsoft.public.win2000.security)
  • Re: SBS2003 blank desktop after login
    ... SBS remote support services. ... mickm at mickmalloy dot dyndns dot org ... See if you can access event logs, services, etc. and get the thing responsive. ... if you log onto the system and log onto another as Administrator you should be able to use psexecfrom the remote to execute something into the console session. ...
    (microsoft.public.windows.server.sbs)
  • Re: Program Will Not Start
    ... Jeff Pitsch wrote: ... The program will run from the server console. ... Recall that if the program is left open and if the remote user logs in with the program already open, ...
    (microsoft.public.windows.terminal_services)
  • Re: Server login hangs
    ... I did a few remote perfmon logs and ... logs show the CPU and disk idle as they usually are. ... I'll come back later and pull the plug on the UPS to force it to shutdown ... If you want to restart the server, on the workstation go to Start -> Run ...
    (microsoft.public.windows.server.sbs)
  • Re: Running programs while logged off
    ... Normally it runs in the background and updates records at user-defined ... remotely (we use RealVNC for remote access). ... It might fall over if somebody logs on remotely and then logs out. ...
    (microsoft.public.windowsxp.general)