Solved

Audit physical logons only, not network logons etc

Posted on 2013-12-12
2
289 Views
Last Modified: 2013-12-20
Hi All

I have been asked to caputure all logon's that are either at the console or via RDP etc, we don't want to capture all the other logons like network etc

What are the event ID's for these on Windows 2003 / 2008R2 servers

Also is it possible to just configure Auditing for this type of Logon via group policy, we have a 2008R2 domain.

Thanks
0
Comment
Question by:ncomper
2 Comments
 
LVL 14

Accepted Solution

by:
Ram Balachandran earned 500 total points
ID: 39714223
Following link contains Event IDs related with logon
http://technet.microsoft.com/en-us/library/cc787567(v=ws.10).aspx
Following link mention how to Define or modify auditing policy settings for an event category
http://technet.microsoft.com/en-us/library/cc787268(v=ws.10).aspx
0
 
LVL 5

Author Closing Comment

by:ncomper
ID: 39731526
Thanks
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
AD FSMO Issues 14 62
Roaming profile & Office 365 3 28
IE 9 will not update to 11 on server 2008 27 13
lync 2013 7 30
In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now