Domain logon auditting - need help

From: Brian Wood (brianw_at_grangercci.com)
Date: 11/22/05 

Date: Tue, 22 Nov 2005 11:11:06 -0600

I'm trying to setup auditting so I can tell when a person logged on in the
morning (we have some salaried people who mgmt thinks are not working their
full 8 hours).

Just to see when they login to the network in the morning, would I want to
select "audit logon events" or "audit account logon events"?

I setup this on one of our DC's with both, and am getting event IDs that are
strange. Per research, it looks like a successful logon should give event
ID 528 but I'm not getting any of those. I'm getting 538 and 540's, all
throughout the day.

Any help would be appreciated.

Relevant Pages

  • Re: Get list of users who logged into Domain Controller?
    ... need to enable "Audit logon events" I suggest you also enable "audit account ... Both of these should be enabled on the domain controller policy. ... > Networks" was missing from the Network Properties. ...
    (microsoft.public.win2000.security)
  • Re: Monitor file system changes
    ... There is AD auditing, and then there's file system and other resource auditing. ... Audit logon events: Security Configuration Editor; ... If both account logon and logon audit policy categories are enabled, logons that use a domain account generate a logon or logoff event on ... ...
    (microsoft.public.windows.server.active_directory)
  • Re: Log-in log-out
    ... In addition to the policy already in place also enable the "Audit logon events" policy, you should then see Events 528. ... Audit account logon events will record events 680 and 681. ...
    (microsoft.public.win2000.general)
  • Windows 2003 (IIS6) security question
    ... If you enable auditing for "Audit Logon Events" or "Audit Account ... would be for a high traffic web server getting an essentail DOS attack ...
    (microsoft.public.inetserver.iis.security)
  • Re: monitor logon time
    ... Appears Audit logon events needs to be turned on also. ... The one you mention is ones the local security system authorised. ... Click on Local Policies/Audit Policies, ...
    (microsoft.public.windowsxp.general)