Solved

audit logon and logoff

Posted on 2009-04-01
5
676 Views
Last Modified: 2012-05-06
Hi All,

I would like to know how I can audit logins and logoffs of all users, or one user specifically.

One of my clients believes his employee may not even be coming into the office at all, and would like to know if I can find out when he/she logs on/off.

Any help or guidance would be appreciated. Thank you!
0
Comment
Question by:tamaneri
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 200 total points
ID: 24039257
Go to group policy editor
edit the group policy for computer
Computer settings
Windows Settings
local policies
Audit policies
enable audit account login events
0
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 200 total points
ID: 24039295
When you view the events in the event viewer, you can simply add a filter to filter out the events for your user.

I'm still looking for a way to create a audit for a specific event.  It's probably doable, but not a standard or general operation
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 300 total points
ID: 24039458
Once you enabled auditing you can either look for the events in the security logs of your domain controllers.
...or if this person uses one machine for the most part then check for 528 and 538 events in the security logs of that PC.
There is also an article here:
http://support.microsoft.com/kb/556015
How to track users logon/logoff
You could also use that simple batch file and run a logon script then give that report to your boss.
Thanks
Mike
 
0
 
LVL 3

Author Comment

by:tamaneri
ID: 24039934
This is great information. Thank you to all of you.

Slight twist. Numnuts never told me he wants this information for his "remote" users. Which don't access the domain. They merely log into OWA and that is all.

Anyway to monitor users logging in/out of OWA other than through the ESM?
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 300 total points
ID: 24040201
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question