Re: Who is Logged On?

From: Steven L Umbach (n9rou_at_nscomcast.net)
Date: 06/24/04 

Date: Thu, 24 Jun 2004 18:44:25 GMT

There is no built in central place to see who is logged onto the domain. You
can see who is accessing shares on any computer via network logon with "net
sessions" or go to Computer Management/shared folders/sessions. If you
enable auditing of account logon events in Domain Controllers Security
Policy a logon event will be recorded in the security log of the domain
controller that authenticated a user. To see logoffs in the log you would
have to enable auditing of logon events. The link below goes into detail on
auditing/intrusion detection using operating system features.--- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

"Jimi" <anonymous@discussions.microsoft.com> wrote in message
news:214a401c45a15$6dd75c60$a001280a@phx.gbl...
> Hello,
>
> I am new to Windows and have been on Netware too long,
> but how can I tell who is logged on to a Windows 2000
> Advanced Server. I can check logged on users in Netware,
> but I do not know how to check logged on users in
> windows. I need to check this just so I can tell if there
> is an intruder.
>
> I know there must be other ways of finding out if there
> is an intruder, but I cannot tell who is logged on now.
> Is there a way to tell in Windows?
>
> Thanks
>
> Jimi

Relevant Pages

  • Re: Log of Logons and Times
    ... If you enable auditing for logon events, ... Using only windows ... xp you can still audit file access, but I'm not sure if you can audit ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: how can i find out who have login to the computer bofore?
    ... Double click on Local Security Policy. ... right click on "Audit logon events". ... In order to enable auditing in XP Pro, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: A way to log when a workstation Locks?
    ... If you enable auditing of logon events, ... logoffs in the security event log, but sadly, not for locking the ... Auditing of logon events has to be enabled on the computer via Local ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Audit Logs
    ... This doesn't repro on Windows .NET Server. ... > Audit Account Logon events - Success & Failure ... > entries are placed into the audit log. ...
    (microsoft.public.win2000.security)
  • Re: Training for Juinior IT Auditor,
    ... what events to audit (eg file access, logon events etc) - which should ... be set via group policy, and some of which is AD anyway. ... it's hard to keep it to windows only... ...
    (microsoft.public.windows.server.security)