Re: User Logon / Logoff

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 09/29/04 

Date: Tue, 28 Sep 2004 19:46:15 -0500

Enable auditing of logon and logoff and view the information in the security
logs in Event Viewer. I don't know exactly where it is enabled offhand since
I use W2K/W2003 but the link below should help. --- Steve

http://www.giac.org/practical/Kathryn_Salyers_GCNT.doc

"djjk" <someone@msdn.com> wrote in message
news:eVyfEOZpEHA.3364@TK2MSFTNGP10.phx.gbl...
> Hi;
>
> Does anyone have any suggestions or ideas on how to capture user's logon &
> logoff times. Currently running NT 4 domain security and Novell 4.12
> security. We are moving to a 2003 AD environment over the next 6 months.
>
> Thanks
> Don
>
>

Relevant Pages

  • Re: Internet Explorer and Outlook Express problems after standby mode
    ... Logon account: Owner ... see Help and Support Center at ... list of network interfaces on the machine. ... > You can access Event Viewer by selecting Start, Administrative Tools, Event ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Event Viewer Error Unknown
    ... The server was unable to logon the Windows NT account 'IUSR_MACHINE' due to the following error: Logon failure: the user has not been granted the requested logon type at this computer. ... Error Reports from Event Viewer can be difficult to interpret so your comments do not surprise me. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Finding Account Lockout Source
    ... I have been able to use the event viewer tool that is in the ... Computer: "Server 123" ... Logon Failure: ...
    (microsoft.public.win2000.security)
  • RE: Security concern - How to read event viewer security line item
    ... The following are few of thousand of items i see in event viewer under ... "ANONYMOUS LOGON"? ... User Logoff: ... see Help and Support Center at ...
    (microsoft.public.windows.server.sbs)
  • Re: Monitor Computer/File Access
    ... You can enable auditing on your computer and then look at the security log ... in Event Viewer to see who has been logging onto or accessing your computer ... over the network assuming you are a local administrator. ... IPC then any user with read access to those shares can copy files from that ...
    (microsoft.public.win2000.security)