the user can set up automatic processes (in Tasks special folder) which also use the user credentials to authenticate/login. I guess if you notice the pattern in the logins in periodic|matching intervals you can safely assume these to be automatic and filter these out. what's left should be interactive logins and from there you can assume something. BUT if, for instance, the user would be using cryptotunnelled VNC to access the computer and log in from remote there would be no way for you to differentiate this login from the one when he/she is actually in the building.
To be 100% sure that they are in the building physically logging in, you would need to go and shake his/her hand daily :D
Main Topics
Browse All Topics
by: richrumblePosted on 2009-07-02 at 18:43:33ID: 24769270
On XP, locking the desktop does create a logoff event, so does fastuser switching(not available in domain joined pc's).This is an interactive lock then logon event stream (in order)
538 Logon type 7 (logoff-type 7 means screen lock, windows+L or ctrl+alt+delete or screen saver lcok)
576 (Special privileges assigned to new logon)
528 Logon type 7(logon - type 7 means unlock)
552 (logon using explicit credentials)
680 (Account used for logon)
http://www.windowsecurity.
That is just one type of login, from a RemoteDesktop session it changes, but only slightly.
Google the codes: http://www.google.com/sear
http://kbase.gfi.com/showa
-rich