Monitor user logins
I am looking for the easiest way to just view user login authentication on our network.
BCipollone
You should be able to view this through eventvwr
ASKER
I can see a PC name but not the user account in the security log. Is there a certain event id to look for?
Agreed, by default all your users authentication requests are logged on the domain controller in the security log. When reviewing the log you can easily filter it out to follow a specific user if you wish.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Not sure if this is what you're looking for, but I posted a related question a while back regarding an easy way to keep track of users and what machines they logged on to. If you're up to the task (requires some vbscript and access to the AD "Description" field, it might be one way to go about it...
https://www.experts-exchange.com/questions/24773750/Add-a-new-custom-field-in-Active-Directory.html
https://www.experts-exchange.com/questions/24773750/Add-a-new-custom-field-in-Active-Directory.html
If you're actively auditing the Logon Events, you'll capture the usernames. Sometimes though, sorting through those security logs on the dc can be time consuming. Keep in mind too, that each DC maintains it's own logs.
A nice MS utility, EVENT COMB tool will help alot, worth checking out. Sure, it can take a while to sort through the multiple DCs, but at least it's a single interface.
http://support.microsoft.com/kb/308471
A nice MS utility, EVENT COMB tool will help alot, worth checking out. Sure, it can take a while to sort through the multiple DCs, but at least it's a single interface.
http://support.microsoft.com/kb/308471
ASKER
Is the logon event id different for Windows Server 2008 R2?