Ability to Monitor User's Logon/Logoff Activity from a Workstation

Posted on 2011-05-10
Last Modified: 2013-11-10
Hello Experts,

I am looking for "custom" ideas on how to centrally monitor user logon/logoff activity.

EXACTLY what we need:

Monitor workstations in domain and record Logon/Logoff activity.
(Already have GPO settings for this: "Audit account logon events", "audit logon events")

I need to pull only certain logs (Logon/Logoff) from workstation, AND I need this to be an automated process.

Can this be done? If so, how?

Any ideas?

Question by:mmoya
    LVL 10

    Accepted Solution

    If the systems are Win7, you can configure a central system as an event collector:

    Or there are log management products like Tripwire Log Center, which I recommend (though it's spendy):

    And dozens of other products:
    LVL 9

    Assisted Solution

    This can be achieved with simple logon/logoff script that writes details to a central log file. Have a look at my previous answer to a similar question, hopefully this will help:

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Join & Write a Comment

    When we want to run, execute or repeat a statement multiple times, a loop is necessary. This article covers the two types of loops in Python: the while loop and the for loop.
    If you’re thinking to yourself “That description sounds a lot like two people doing the work that one could accomplish,” you’re not alone.
    The viewer will learn how to user default arguments when defining functions. This method of defining functions will be contrasted with the non-default-argument of defining functions.
    The viewer will learn how to clear a vector as well as how to detect empty vectors in C++.

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now