?
Solved

audit logon and logoff

Posted on 2009-04-01
5
Medium Priority
?
701 Views
Last Modified: 2012-05-06
Hi All,

I would like to know how I can audit logins and logoffs of all users, or one user specifically.

One of my clients believes his employee may not even be coming into the office at all, and would like to know if I can find out when he/she logs on/off.

Any help or guidance would be appreciated. Thank you!
0
Comment
Question by:tamaneri
  • 2
  • 2
5 Comments
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 800 total points
ID: 24039257
Go to group policy editor
edit the group policy for computer
Computer settings
Windows Settings
local policies
Audit policies
enable audit account login events
0
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 800 total points
ID: 24039295
When you view the events in the event viewer, you can simply add a filter to filter out the events for your user.

I'm still looking for a way to create a audit for a specific event.  It's probably doable, but not a standard or general operation
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 1200 total points
ID: 24039458
Once you enabled auditing you can either look for the events in the security logs of your domain controllers.
...or if this person uses one machine for the most part then check for 528 and 538 events in the security logs of that PC.
There is also an article here:
http://support.microsoft.com/kb/556015
How to track users logon/logoff
You could also use that simple batch file and run a logon script then give that report to your boss.
Thanks
Mike
 
0
 
LVL 3

Author Comment

by:tamaneri
ID: 24039934
This is great information. Thank you to all of you.

Slight twist. Numnuts never told me he wants this information for his "remote" users. Which don't access the domain. They merely log into OWA and that is all.

Anyway to monitor users logging in/out of OWA other than through the ESM?
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1200 total points
ID: 24040201
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question