Solved

Audit physical logons only, not network logons etc

Posted on 2013-12-12
2
293 Views
Last Modified: 2013-12-20
Hi All

I have been asked to caputure all logon's that are either at the console or via RDP etc, we don't want to capture all the other logons like network etc

What are the event ID's for these on Windows 2003 / 2008R2 servers

Also is it possible to just configure Auditing for this type of Logon via group policy, we have a 2008R2 domain.

Thanks
0
Comment
Question by:ncomper
2 Comments
 
LVL 14

Accepted Solution

by:
Ram Balachandran earned 500 total points
ID: 39714223
Following link contains Event IDs related with logon
http://technet.microsoft.com/en-us/library/cc787567(v=ws.10).aspx
Following link mention how to Define or modify auditing policy settings for an event category
http://technet.microsoft.com/en-us/library/cc787268(v=ws.10).aspx
0
 
LVL 5

Author Closing Comment

by:ncomper
ID: 39731526
Thanks
0

Featured Post

[Webinar] Disaster Recovery and Cloud Management

Learn from Unigma and CloudBerry industry veterans which providers are best for certain use cases and how to lower cloud costs, how to grow your Managed Services practice in IaaS clouds, and how to utilize public cloud for Disaster Recovery

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now