Solved

Explaination of Security Logs

Posted on 2009-07-02
3
226 Views
Last Modified: 2013-12-04
Hello,

    I'm curious to truely log a person's logon's and logoff's what event ID codes would one need to monitor?  Throughout the day, I know it is not abnormal to have 50, 60, 70 logon and logoff's in a days time i.e. Event ID: 528, 540 and 538, but not all of these are from the user alone, some of these entries are caused by the network, system ect....  

    How can you truely tell though if through user logon/logoff intervention that person is logging in or logging off of their system, something that would prove without a shadow of a doubt electronically that they are in the building physically logging and logging off their system.   What event ID codes would signify this?  

     Also, would doing a Control + Alt + Delete and locking the system generate a logout event ID i.e. 538 ? I'm assuming if it did log it as a 538 that logging back into that machine from a lock would generate  an event ID of 528 or 540.
0
Comment
Question by:itsmevic
3 Comments
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 250 total points
ID: 24769270
On XP, locking the desktop does create a logoff event, so does fastuser switching(not available in domain joined pc's).This is an interactive lock then logon event stream (in order)
538 Logon type 7 (logoff-type 7 means screen lock, windows+L or ctrl+alt+delete or screen saver lcok)
576 (Special privileges assigned to new logon)
528 Logon type 7(logon - type 7 means unlock)
552 (logon using explicit credentials)
680 (Account used for logon)
http://www.windowsecurity.com/articles/Logon-Types.html
That is just one type of login, from a RemoteDesktop session it changes, but only slightly.
Google the codes: http://www.google.com/search?hl=en&q=site%3Amicrosoft.com+event+id+540
http://kbase.gfi.com/showarticle.asp?id=KBID002974
-rich





0
 
LVL 8

Assisted Solution

by:jako
jako earned 250 total points
ID: 24778457
the user can set up automatic processes (in Tasks special folder) which also use the user credentials to authenticate/login. I guess if you notice the pattern in the logins in periodic|matching intervals you can safely assume these to be automatic and filter these out. what's left should be interactive logins and from there you can assume something. BUT if, for instance, the user would be using cryptotunnelled VNC to access the computer and log in from remote there would be no way for you to differentiate this login from the one when he/she is actually in the building.

To be 100% sure that they are in the building physically logging in, you would need to go and shake his/her hand daily :D
0
 

Author Closing Comment

by:itsmevic
ID: 31599338
Thank you
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
There's a lot of hype surrounding blockchain technology. Here's how it works and some of the novel ways it' s now being used - including for data protection.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question