Re: Can you log the use of a workstation?

From: Your name (anononymous_at_ssr.com)
Date: 04/27/04 

Date: Mon, 26 Apr 2004 15:28:34 -0700

Thanks Steve,

I'm going to look into it.

Steven L Umbach wrote:

> You could try enabling auditing of process tracking but be sure to make the
> security log quite a bit bigger. Also look into enabling of object access
> and the audit the specific files in question, including executeables. The
> information will be in the logs, but it will take a while to sort it all
> out. I would try the file auditing before using process tracking, but audit
> only a few permissions for as few files as possible to keep the number of
> events generated down. --- Steve
>
> http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260
>
> "Your name" <anononymous@ssr.com> wrote in message
> news:40897674.EFD341D7@ssr.com...
> >
> >
> > Steven L Umbach wrote:
> >
> > > You can enable auditing of logon events in the Local Security Policy of
> that
> > > computer. Just make sure that he is not also an administrator if at all
> > > possible because if he got wind of that, he may be able to configure a
> > > scrip/AT or Scheduled Task to have the computer log him off at a certain
> > > time or change the system time.
> >
> > We don't have to worry about that, the user isn't savvy enough to do that.
> >
> >
> > > You can also search for files on his computer and select the option to
> search
> > > by date and select a range. That information may be helpful in showing
> what
> > > files he closed/modified at what
> > > times or also checking the properties of the files in his folder for
> > > modified time stamp
> >
> > We've done that, but the problem is that we cannot tell precisely how long
> it
> > took for the user to actually work on the file, and we don't know when the
> user
> > started the application to modify the file.
> >
> > BTW, is there a way to at least see what apps were opened and for how
> long?
> >
> > > . --- Steve
> > >
> > > "Your name" <anononymous@ssr.com> wrote in message
> > > news:40896259.BFDCA122@ssr.com...
> > > > Hello,
> > > >
> > > > We have a situation here that unfortunately, merits this question. The
> > > > situation; we have an employee that is claiming to spend many hours on
> > > > the weekend on their workstation, but we suspect that is actually not
> > > > the case. The question; is there a way to log the use of a user on the
> > > > workstation that they are working on?
> > > >
> > > > TIA for your reply.
> > > >
> > > >
> > > >
> >

Relevant Pages

  • Re: auditing question - single file object access creates duplicate security log messages
    ... object access, ... go into the NTFS permissions and audit only success on deletion, creation, ... > one audit message in the security log when a file is read. ...
    (microsoft.public.win2000.security)
  • Re: Event Viewer Getting Full
    ... auditing of object access must be enabled. ... http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml -- PsLogList to dump lof ... You can increase the size of the security log and by default it ... >> audit for only specific files and avoid using the users and everyone group to ...
    (microsoft.public.win2000.security)
  • Re: File Auditing
    ... The nature of auditing of object access is that there will be many seemingly ... but instead create a global group or local groups of users you want to audit. ... avoid auditing write or you will continue to large amounts in the security log. ...
    (microsoft.public.win2000.security)
  • Re: duplicate eventID 560?
    ... Object access will generate a ton of events in the ... security log. ... When you configure auditing of a folder be sure to audit the ...
    (microsoft.public.security)
  • Re: duplicate eventID 560?
    ... Object access will generate a ton of events in the ... > security log. ... When you configure auditing of a folder be sure to audit the ...
    (microsoft.public.security)