Avatar of lakshmanl
Flag for Afghanistan asked on

User Logon/Logoff tracking

Hi All,
I am trying to track the logon/logoff activity of  users.  I have turned on "Audit Logon Events"  and when I look in the event log, I get IDs 538,576 & 540  repeatedly for the same user id.  These occur almost constantly for each user
and there can be hundreds of logon/logoff events for the same user in the
same day.

Wat have I got configured wrong?  I know our users are not actually logging on and off that often.

Thanks and regards

Windows Server 2003

Avatar of undefined
Last Comment

8/22/2022 - Mon

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

Hi mass2612,

Done a bit more reading since my post.

So... what would be the best way to capture userlogon/logoff activites? - scripts in Logon/Logoff in group policy?


Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes