Solved

audit logon and logoff

Posted on 2009-04-01
5
661 Views
Last Modified: 2012-05-06
Hi All,

I would like to know how I can audit logins and logoffs of all users, or one user specifically.

One of my clients believes his employee may not even be coming into the office at all, and would like to know if I can find out when he/she logs on/off.

Any help or guidance would be appreciated. Thank you!
0
Comment
Question by:tamaneri
  • 2
  • 2
5 Comments
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 200 total points
ID: 24039257
Go to group policy editor
edit the group policy for computer
Computer settings
Windows Settings
local policies
Audit policies
enable audit account login events
0
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 200 total points
ID: 24039295
When you view the events in the event viewer, you can simply add a filter to filter out the events for your user.

I'm still looking for a way to create a audit for a specific event.  It's probably doable, but not a standard or general operation
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 300 total points
ID: 24039458
Once you enabled auditing you can either look for the events in the security logs of your domain controllers.
...or if this person uses one machine for the most part then check for 528 and 538 events in the security logs of that PC.
There is also an article here:
http://support.microsoft.com/kb/556015
How to track users logon/logoff
You could also use that simple batch file and run a logon script then give that report to your boss.
Thanks
Mike
 
0
 
LVL 3

Author Comment

by:tamaneri
ID: 24039934
This is great information. Thank you to all of you.

Slight twist. Numnuts never told me he wants this information for his "remote" users. Which don't access the domain. They merely log into OWA and that is all.

Anyway to monitor users logging in/out of OWA other than through the ESM?
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 300 total points
ID: 24040201
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Resolve DNS query failed errors for Exchange
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now