Solved

login auditing

Posted on 2003-10-22
8
137 Views
Last Modified: 2010-04-14
Is it possible too log everytime someone logs into and out of a client in my domain from a domain controller?
0
Comment
Question by:donnatronious
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 11

Accepted Solution

by:
adonis1976 earned 125 total points
ID: 9603061
yeah, enable object access auditing.
0
 
LVL 41

Expert Comment

by:graye
ID: 9604059
Let's be clear....

If you want to know when anybody logs into their domain account anywhere in the network, then you turn on auditing at the Domain Controllers for:
    Audit Account Login Events

But, if you want to know when somebody logs into a specific PC (with either or domain or local acount), then you turn on auditing on that PC for:
    Audit Login Events

...or both!
0
 

Author Comment

by:donnatronious
ID: 9604095
this is under the group policy of the domain controller right?
0
 
LVL 17

Expert Comment

by:paulop1975
ID: 9604103
To accomplish this you'll need to open Control Panel -> Administrative Tools -> Local Security Policy and on the left-pane select Local Policies\Audit Policies.
Then on the right-pane you should be able to see "Audit Account Logon Event" (this one you're looing for) and many other.

Good hunting!
;)
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 17

Expert Comment

by:paulop1975
ID: 9604115
For the Server version of Windows it should be similar.
Sorry but I don't remember the correct way to get to Global Policies. Mine is Windows 2000 Professional.
:(

Good luck on the search!

pAul0|PIm3NTA
0
 
LVL 17

Expert Comment

by:paulop1975
ID: 9604120
Thursday, October 23, 2003
4:12 AM
No cigarettes left......... shouldn't I be sleeping??
:S
0
 

Author Comment

by:donnatronious
ID: 9604170
hmm, I thought I put a comment a minute ago but it didn't show up.

My goal which I should have made clear in the original question is too see failures when someone tries too authenticate with an incorrect password.  adonis1976's solution accomplishes this but graye and paulop1975 do not.  I just tested it.

Thanks

0
 
LVL 41

Expert Comment

by:graye
ID: 9605968
Not to belabor the point... but one of the major difference in Audit Login Events and Audit Account Login Events is... "Audit Login Event" will only capture events where the UserID is valid... whereas "Audit Account Login Events" will capture events where the UserID doesn't even exist.

That's why they are almost always used together...  one to discover UserID guessing, and one to discover Password guessing.
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Introduction This article is intended for those who are new to PHP error handling (https://www.experts-exchange.com/articles/11769/And-by-the-way-I-am-New-to-PHP.html).  It addresses one of the most common problems that plague beginning PHP develop…
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now