• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 316
  • Last Modified:

Audit physical logons only, not network logons etc

Hi All

I have been asked to caputure all logon's that are either at the console or via RDP etc, we don't want to capture all the other logons like network etc

What are the event ID's for these on Windows 2003 / 2008R2 servers

Also is it possible to just configure Auditing for this type of Logon via group policy, we have a 2008R2 domain.

1 Solution
Ram BalachandranCommented:
Following link contains Event IDs related with logon
Following link mention how to Define or modify auditing policy settings for an event category
ncomperAuthor Commented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now