Re: Windows user logging

From: Steven L Umbach (sumbach55_at_ameritech.net)
Date: 11/13/03


Date: Thu, 13 Nov 2003 14:59:33 GMT

You would have to enable auditing of logon events for that computer to see
when a user is logging on/off and examine security log in Event Viewer
[which can be done remotely]. It will be difficult to monitor applications
used because either you will need to enable auditing of object access and
then configure folder/files to audit and/or enable auditing of process
tracking. Both of those can generate gazillions on events in the security
log. Keyboard loggers can be used but there are ethical and legal
considerations to take into account. As far as web sites, something like ISA
proxy server [very detailed tracking] or certain internet appliances are
able to track internet useage and you could view a users history folder in
their profile and their cookies/temporary internet files. Personal firewalls
such as Sygate can also log detailed network/internet activity. --- Steve

http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260

"Chris Halgryn" <chrish@xnet.co.za> wrote in message
news:0f4d01c3a9f3$399096b0$a101280a@phx.gbl...
> Is there a way of logging (recording) user activity on MS
> Windows 2000 Pro? For example times and dates of users
> logging in and out, programs used and Internet sites
> visited.
>
> Kind regards,
> Chris Halgryn
> Xnet Internet



Relevant Pages

  • RE: Router Internet Monitoring
    ... Problem with Pix is it is logging literally everything, ... Can you use the Cisco Pix Device Manager to filter the log? ... Subject: Router Internet Monitoring ... Modeled after the famous Black Hat event in ...
    (Security-Basics)
  • RE: Router Internet Monitoring
    ... Problem with Pix is it is logging literally everything, ... Can you use the Cisco Pix Device Manager to filter the log? ... Subject: Router Internet Monitoring ... Modeled after the famous Black Hat event in ...
    (Firewall-Wizards)
  • [fw-wiz] RE: Router Internet Monitoring
    ... Problem with Pix is it is logging literally everything, ... fully explored filtering, we use Kiwi Syslog Daemon for logging but the file ... Can you use the Cisco Pix Device Manager to filter the log? ... Subject: Router Internet Monitoring ...
    (Firewall-Wizards)
  • Re: Enabling logging on IPC$ share ?
    ... You should hope to see no access from the internet to a domain ... controller unless this is a intrusion detection project on a non production DC. ... events will give you the most information in conjunction with firewall logs. ... I have enabled all kinds of logging, ...
    (microsoft.public.win2000.security)
  • Re: Intrusion lockout source
    ... If you enable auditing of logon events it should give you the name of an ... Attempts from the internet should be stopped ... links below for more information on auditing and lockout issues. ...
    (microsoft.public.win2000.security)