Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

audit logon and logoff

Posted on 2009-04-01
5
Medium Priority
?
695 Views
Last Modified: 2012-05-06
Hi All,

I would like to know how I can audit logins and logoffs of all users, or one user specifically.

One of my clients believes his employee may not even be coming into the office at all, and would like to know if I can find out when he/she logs on/off.

Any help or guidance would be appreciated. Thank you!
0
Comment
Question by:tamaneri
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 800 total points
ID: 24039257
Go to group policy editor
edit the group policy for computer
Computer settings
Windows Settings
local policies
Audit policies
enable audit account login events
0
 
LVL 8

Assisted Solution

by:halejr1
halejr1 earned 800 total points
ID: 24039295
When you view the events in the event viewer, you can simply add a filter to filter out the events for your user.

I'm still looking for a way to create a audit for a specific event.  It's probably doable, but not a standard or general operation
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 1200 total points
ID: 24039458
Once you enabled auditing you can either look for the events in the security logs of your domain controllers.
...or if this person uses one machine for the most part then check for 528 and 538 events in the security logs of that PC.
There is also an article here:
http://support.microsoft.com/kb/556015
How to track users logon/logoff
You could also use that simple batch file and run a logon script then give that report to your boss.
Thanks
Mike
 
0
 
LVL 3

Author Comment

by:tamaneri
ID: 24039934
This is great information. Thank you to all of you.

Slight twist. Numnuts never told me he wants this information for his "remote" users. Which don't access the domain. They merely log into OWA and that is all.

Anyway to monitor users logging in/out of OWA other than through the ESM?
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1200 total points
ID: 24040201
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question