Re: Get list of users who logged into Domain Controller?

From: Glenn L (the.only(delete)_at_gmail.com)
Date: 11/10/04 

Date: Tue, 9 Nov 2004 21:29:58 -0800

If you want to know who is logging on locally to your domain controller, you
need to enable "Audit logon events" I suggest you also enable "audit account
logon events"
Both of these should be enabled on the domain controller policy. 

-- 
Glenn L
CCNA, MCSE (2000,2003) + Security
"ohaya" <ohaya@cox.net> wrote in message news:41915502.F3FA0F54@cox.net...
> Hi,
>
> I know that this is after-the-fact, but is there anything in a Windows
> 2000 Domain Controller (Windows 2000 Advanced Server) that would allow
> us to see who has logged into the DC over time?
>
> We had a very strange incident that appears to have started at the end
> of last week, just before the weekend, where all of a sudden, a lot of
> things stopped working (not being able to log onto shared drives,
> etc.).
> I just helped getting things working again this evening, and I was kind
> of surprised that the end resolution was that the "Client for Microsoft
> Networks" was missing from the Network Properties.  Once we re-installed
> that, everything appeared to start working, for which I was very
> grateful, but now I'm beginning to wonder how that could have happened.
>
> One of the possibilities that I'm wondering about is if someone might
> have either inadverdently or maliciously gone in and removed Client for
> Microsoft Networks.
>
> Thanks in advance,
> Jim

Relevant Pages

  • Re: Auditing Logon events on Windows 2003 DC
    ... I have read that article before, the problem is the Audit Logon events ... are not writing to the domain controller. ... >>I am trying to monitor logon failures on our domain controllers. ...
    (microsoft.public.windows.server.active_directory)
  • Events: Logon vs Account Logon
    ... Aren't "account logon events" going to happen on DC? ... Which event category will you audit on the domain controller to gather the necessary information? ...
    (microsoft.public.cert.exam.mcsa)
  • Re: Auditing Logon Events
    ... Logon events will generate a lot of activity as it also records computer accounts ... logging on to the domain controller. ... > have tried turning on Audit Logon Event on the Group ...
    (microsoft.public.win2000.security)
  • Re: security log anomolies
    ... > have both account logon and logon events enabled for success and failure. ... > overriding Local Security Policy. ... > controllers in particular as Domain Controller Security Policy will override ...
    (microsoft.public.win2000.security)
  • Re: Monitor file system changes
    ... There is AD auditing, and then there's file system and other resource auditing. ... Audit logon events: Security Configuration Editor; ... If both account logon and logon audit policy categories are enabled, logons that use a domain account generate a logon or logoff event on ... ...
    (microsoft.public.windows.server.active_directory)