pstre
asked on
Window Server 2008 - Audit logs
I need to track when users are logging in to Windows Server 2008. What is the process to do this? We use Active Directory.. Thank you!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Moe Granular example are below , you can create the Group Policy by following below article.
http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/
http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/
In active directory, in default domain controller policy, just enable audit account logon events in audit policy so that any time user logon to domain on any workstation \ server, it will generate logon event on domain controller which tells you that user is logged on to domain resources
Also on OU containing 2008 servers, apply new GPO and in GPO set audit logon events in audit policy for success and failures so that any time any user will logon to 2008 server it will generate events on 2008 server
In case you want to audit active directory you can check below link for more details
http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx
Mahesh
Also on OU containing 2008 servers, apply new GPO and in GPO set audit logon events in audit policy for success and failures so that any time any user will logon to 2008 server it will generate events on 2008 server
In case you want to audit active directory you can check below link for more details
http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx
Mahesh
You might need to go into Local Security Policy in the default GPO to activate that option. Onc3e that is done, go to event viewer, Windows Logs, security and you will see the events of logins & logout.
Start>All Programs>Administrative Tools>Event Viewer
Or eventvwr.msc in the run box
Windows Logs> Security
Several different messages are usually logged for each logon event so keep that in mind if you are looking for specific users ect...