Re: Monitoring user access.

"Spurklie" <Spurklie@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:8ADFF832-F167-4033-86BA-43640CE03C11@xxxxxxxxxxxxxxxx
I suspect someone may have gone on to my computer in my user name while I was
not at home. (They knew my password, which I have now changed). Is there a
log within xp sp2 with details of who has logged in and when?


If you're running Windows XP Home Edition go to Start -> Control Panel ->
Administrative Tools and open up the Event Viewer. In the left hand column,
click on Security. In the right hand pane, click on the User column. Scroll down
to your user name and look for successful Logon/Logoff events.

If you're running XP Professional, you'll have to enable auditing of logon
events. You can do that through the local
security policy. Once this is done you'll be able to view future logon events in
Event Viewer using the procedure
outlined above.

Go to Start -> Control Panel -> Administrative Tools and double click on Local
Security Policy.
In the Local Security Policy editor, navigate to this policy.

Security Settings\Local Policies\Audit Policy

In the right hand pane, right click on Audit logon events.
Select Properties from the menu.
Put a check mark in the box next to both Success and Failure.
Click OK.

Keep in mind that if you're running XP Professional, enabling auditing of logon
events at this time will not allow you to view any unauthorized activity that
happened in the past. It will start recording future logon events.

For more info, take a look at these articles.

Audit Policy Settings
http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch03.mspx#ETE

How To Enable Security Auditing in Windows XP Pro
http://netsecurity.about.com/cs/tutorials/ht/ht040503.htm

Good luck

Nepatsfan



.

Relevant Pages

  • Re: whos loggin on when?
    ... future logon events in Event Viewer using the procedure ... click on Local Security Policy. ... In the Local Security Policy editor, ... In the right hand pane, right click on Audit logon events. ...
    (microsoft.public.windowsxp.general)
  • Re: How do I find out when user XXX logged in+out on last Tuesday? Event log entry possible?
    ... You can do that through the local security policy. ... In the right hand pane, right click on Audit logon events. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Windows XP User logs
    ... You can do that through the local security policy. ... In the right hand pane, right click on Audit logon events. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: users activity
    ... You want to make sure that auditing of account logon and or logon events is ... Domain Controller Security Policy. ... For instance i want to know when a user log in the server,when was the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Many events in Security log
    ... If you do not want those events then disable auditing in "Domain Controller ... Security Policy" which is where you manage auditing for domain controllers. ... >> memory and cpu usage with Task Manager. ...
    (microsoft.public.windows.server.security)