Monitor user logins

I am looking for the easiest way to just view user login authentication on our network.
drgleocklerAsked:
Who is Participating?
 
TheMetalicOneConnect With a Mentor Commented:
Look for the category Logon/Logoff or event ID 540

You can also right click on the security log and go to properties, click on the filter tab and then you can enter in the username if you wish.
0
 
BCipolloneCommented:
You should be able to view this through eventvwr
0
 
drgleocklerAuthor Commented:
I can see a PC name but not the user account in the security log. Is there a certain event id to look for?
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
TheMetalicOneCommented:
Agreed, by default all your users authentication requests are logged on the domain controller in the security log.  When reviewing the log you can easily filter it out to follow a specific user if you wish.
0
 
ThinkPaperIT ConsultantCommented:
Not sure if this is what you're looking for, but I posted a related question a while back regarding an easy way to keep track of users and what machines they logged on to. If you're up to the task (requires some vbscript and access to the AD "Description" field, it might be one way to go about it...

http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_24773750.html
0
 
BobintheNocCommented:
If you're actively auditing the Logon Events, you'll capture the usernames.  Sometimes though, sorting through those security logs on the dc can be time consuming.  Keep in mind too, that each DC maintains it's own logs.

A nice MS utility, EVENT COMB tool will help alot, worth checking out.  Sure, it can take a while to sort through the multiple DCs, but at least it's a single interface.
http://support.microsoft.com/kb/308471
0
 
drgleocklerAuthor Commented:
Is the logon event id different for Windows Server 2008 R2?
0
All Courses

From novice to tech pro — start learning today.