Solved

Explaination of Security Logs

Posted on 2009-07-02
3
225 Views
Last Modified: 2013-12-04
Hello,

    I'm curious to truely log a person's logon's and logoff's what event ID codes would one need to monitor?  Throughout the day, I know it is not abnormal to have 50, 60, 70 logon and logoff's in a days time i.e. Event ID: 528, 540 and 538, but not all of these are from the user alone, some of these entries are caused by the network, system ect....  

    How can you truely tell though if through user logon/logoff intervention that person is logging in or logging off of their system, something that would prove without a shadow of a doubt electronically that they are in the building physically logging and logging off their system.   What event ID codes would signify this?  

     Also, would doing a Control + Alt + Delete and locking the system generate a logout event ID i.e. 538 ? I'm assuming if it did log it as a 538 that logging back into that machine from a lock would generate  an event ID of 528 or 540.
0
Comment
Question by:itsmevic
3 Comments
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 250 total points
ID: 24769270
On XP, locking the desktop does create a logoff event, so does fastuser switching(not available in domain joined pc's).This is an interactive lock then logon event stream (in order)
538 Logon type 7 (logoff-type 7 means screen lock, windows+L or ctrl+alt+delete or screen saver lcok)
576 (Special privileges assigned to new logon)
528 Logon type 7(logon - type 7 means unlock)
552 (logon using explicit credentials)
680 (Account used for logon)
http://www.windowsecurity.com/articles/Logon-Types.html
That is just one type of login, from a RemoteDesktop session it changes, but only slightly.
Google the codes: http://www.google.com/search?hl=en&q=site%3Amicrosoft.com+event+id+540
http://kbase.gfi.com/showarticle.asp?id=KBID002974
-rich





0
 
LVL 8

Assisted Solution

by:jako
jako earned 250 total points
ID: 24778457
the user can set up automatic processes (in Tasks special folder) which also use the user credentials to authenticate/login. I guess if you notice the pattern in the logins in periodic|matching intervals you can safely assume these to be automatic and filter these out. what's left should be interactive logins and from there you can assume something. BUT if, for instance, the user would be using cryptotunnelled VNC to access the computer and log in from remote there would be no way for you to differentiate this login from the one when he/she is actually in the building.

To be 100% sure that they are in the building physically logging in, you would need to go and shake his/her hand daily :D
0
 

Author Closing Comment

by:itsmevic
ID: 31599338
Thank you
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
What is CEO Fraud? 8 90
Sweet32 Vulnerability in Microsoft IIS7.5 6 414
Palo Alto Networks - find the sec zone 3 50
Read Only access to a Facebook Profile 9 23
If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
Knowing where your website is hosted is as important as the features you receive, the monthly fee, and the support you receive. Due diligence should be done when choosing your next hosting provider.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question