Solved

audit logon and logoff

Posted on 2009-04-01
5
680 Views
Last Modified: 2012-05-06
Hi All,

I would like to know how I can audit logins and logoffs of all users, or one user specifically.

One of my clients believes his employee may not even be coming into the office at all, and would like to know if I can find out when he/she logs on/off.

Any help or guidance would be appreciated. Thank you!
0
Comment
Question by:tamaneri
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 200 total points
ID: 24039257
Go to group policy editor
edit the group policy for computer
Computer settings
Windows Settings
local policies
Audit policies
enable audit account login events
0
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 200 total points
ID: 24039295
When you view the events in the event viewer, you can simply add a filter to filter out the events for your user.

I'm still looking for a way to create a audit for a specific event.  It's probably doable, but not a standard or general operation
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 300 total points
ID: 24039458
Once you enabled auditing you can either look for the events in the security logs of your domain controllers.
...or if this person uses one machine for the most part then check for 528 and 538 events in the security logs of that PC.
There is also an article here:
http://support.microsoft.com/kb/556015
How to track users logon/logoff
You could also use that simple batch file and run a logon script then give that report to your boss.
Thanks
Mike
 
0
 
LVL 3

Author Comment

by:tamaneri
ID: 24039934
This is great information. Thank you to all of you.

Slight twist. Numnuts never told me he wants this information for his "remote" users. Which don't access the domain. They merely log into OWA and that is all.

Anyway to monitor users logging in/out of OWA other than through the ESM?
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 300 total points
ID: 24040201
0

Featured Post

Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the steps required to use the default Photos screensaver to display branding/corporate images
A hard and fast method for reducing Active Directory Administrators members.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question