We have about 200 workers from around the country that login and work remotely. They login according to their jobs.
Some login to....
* a VPN (this is a Linux machine) this authenticates via AD.
* Outlook (RPC over HTTP)
* Target Process
This is a volunteer project and we just need to see who is active. So we would like to see if there is any software we already have or that we can get to record ever time someone authenticates via AD no matter if it is the VPN, OWA, Outlook ETC. Most server are 2008 R2 Datacenter.
Network made up of 2 DC, Exchange 2010 with an Edge Server, MS Threat Management Gateway, SharePoint 3.0 moving to 2010, WSUS, AV, 2 Spiceworks, Target Process, etc etc.
(MS Threat Management Gateway is not being used as a firewall it is used to publish things like SharePoint OWA etc to the internet so we do not have to use the VPN for those things)