logfile file determine who has logged in?

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

On Windows XP, assuming root/Administratorprivileges, is there a
logfile that records when users have logged in/out? My first look at
*.log files only shows files that are locked in use.

What I am really looking for is log files that record user activity in
more detail, but login/out is a start. TIA.
2 answers Last reply
More about logfile file determine logged
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
    http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&Product=winxp

    R-Guard Data Security Software
    http://www.data-security-software.com/

    --
    Carey Frisch
    Microsoft MVP
    Windows XP - Shell/User
    Microsoft Newsgroups

    Be Smart! Protect Your PC!
    http://www.microsoft.com/athome/security/protect/default.mspx

    ------------------------------------------------------------------------------

    "Kevin" wrote:

    | On Windows XP, assuming root/Administratorprivileges, is there a
    | logfile that records when users have logged in/out? My first look at
    | *.log files only shows files that are locked in use.
    |
    | What I am really looking for is log files that record user activity in
    | more detail, but login/out is a start. TIA.
  2. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Kevin wrote:

    > On Windows XP, assuming root/Administratorprivileges, is there a
    > logfile that records when users have logged in/out? My first look at
    > *.log files only shows files that are locked in use.
    >
    > What I am really looking for is log files that record user activity in
    > more detail, but login/out is a start. TIA.
    Hi

    If you enable auditing of logon events, you will find entries for
    logons and logoffs in the security event log.

    Auditing of logon events has to be enabled on the computer via Local
    Security Policy or possibly domain level if in a domain. Then you can
    search the security log for the following events:

    Interactive logon: Event ID 528 containing Logon Type 2
    Interactive logoff: Event ID 538 containing Logon Type 2


    HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
    http://support.microsoft.com/default.aspx?scid=kb;en-us;310399


    --
    torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
    Administration scripting examples and an ONLINE version of
    the 1328 page Scripting Guide:
    http://www.microsoft.com/technet/scriptcenter/default.mspx
Ask a new question

Read More

Security Microsoft Windows XP