gopher_49
asked on
user logon autiding
I'm trying to track down the logon/logout activity for a user's remote desktop session or at least when they logged into the computer.. Is this possible by default or do I need login auditing enabled? What about the DC? I guess that stands true for the DC too?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
This should help, but it's a lot harder to find in the logs:
http://blogs.msdn.com/b/ericfitz/archive/2008/08/20/tracking-user-logon-activity-using-logon-events.aspx
http://blogs.msdn.com/b/ericfitz/archive/2008/08/20/tracking-user-logon-activity-using-logon-events.aspx
ASKER
lazzarus98,
The logon/logoff events are only displayed is the local group policy has user logon auditing turned on. It is not turned on right now so the information I need will not be in the event log I guess.
The logon/logoff events are only displayed is the local group policy has user logon auditing turned on. It is not turned on right now so the information I need will not be in the event log I guess.
ASKER