Re: Too many Logon/Logoff security log entries

From: Danny Sanders (Danny.Sanders_at_NO-SPAMcpcmed.org)
Date: 09/29/05 

Date: Thu, 29 Sep 2005 13:20:12 -0600

> I only need data/times for logging on/off
> workstations for documenting when employees start and end their work day.

That would be best accomplished with time cards.

There is no way the computer can distinguish whether a particular logon is
"the beginning of a user's day" or connecting to a resource.

hth
DDS W 2k MVP MCSE

"JohnK" <JohnK@discussions.microsoft.com> wrote in message
news:1B56B5A2-6554-4557-B8E0-D11373039D28@microsoft.com...
> I've been asked to modify what DC's audit to make it easier to identify
> user
> logon and logoff events. I only need data/times for logging on/off
> workstations for documenting when employees start and end their work day.
> I
> do not need to log every authentication event every time the employee
> accesses a network resource. Based on the articles I've read, "Audit
> Logon
> Events" in the Default DC Policy seems to be the events I'm looking for;
> however even with all other audit policies being undefined I still get
> multiple events every minute (one event every 1 - 5 seconds) in the
> security
> log. I built a test domain (Windows 2000 - native) consisting of one DC
> and
> one workstation. The default domain policy's audit entries are all set to
> "Not defined" and the default domain controllers policy's "Audit logon
> events" is set to record "success" events. There are no other GPO's. How
> can I further reduce logged events to be more concise?

Relevant Pages

  • Re: employee monitoring
    ... monitoring software for our employees which will run off of the Small ... be hidden on the workstations and can be excluded ... Calling an illegal alien an "undocumented worker" is like calling a ...
    (microsoft.public.windows.server.sbs)
  • Re: employee monitoring
    ... monitoring software for our employees which will run off of the ... be hidden on the workstations and can be ... Email monitoring and archiving - We archive ALL USERS EMAILS (in ...
    (microsoft.public.windows.server.sbs)
  • Re: Rating Database Access 2003
    ... I am not trying to link it to a spreadsheet, I want to start a new system to ... rate and compile rating data on employees. ... Empl Id, name, dept, supv name, audit number ...
    (microsoft.public.access.tablesdbdesign)
  • Re: Remote PC Administration
    ... I need a way to authenticate those users from remote locations. ... > to 75 workstations and still be legal. ... >>> We already know you have more than 75 employees ... >>> at a central station with a static ip. ...
    (microsoft.public.windows.server.sbs)
  • Re: Best practive for setting up 3 sbs servers
    ... How many employees (and workstations) are engaged in the cross-company ... you could VPN into another companies server to ... Merv Porter [SBS MVP] ...
    (microsoft.public.windows.server.sbs)