Sign in with
Sign up | Sign in
Your question

logfile file determine who has logged in?

Tags:
  • Security
  • Microsoft
  • Windows XP
Last response: in Windows XP
Share
Anonymous
a b 8 Security
February 16, 2005 6:09:50 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

On Windows XP, assuming root/Administratorprivileges, is there a
logfile that records when users have logged in/out? My first look at
*.log files only shows files that are locked in use.

What I am really looking for is log files that record user activity in
more detail, but login/out is a start. TIA.

More about : logfile file determine logged

Anonymous
a b 8 Security
February 16, 2005 6:09:51 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&Product=winxp

R-Guard Data Security Software
http://www.data-security-software.com/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/defaul...

------------------------------------------------------------------------------

"Kevin" wrote:

| On Windows XP, assuming root/Administratorprivileges, is there a
| logfile that records when users have logged in/out? My first look at
| *.log files only shows files that are locked in use.
|
| What I am really looking for is log files that record user activity in
| more detail, but login/out is a start. TIA.
Anonymous
a b 8 Security
February 16, 2005 10:43:54 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Kevin wrote:

> On Windows XP, assuming root/Administratorprivileges, is there a
> logfile that records when users have logged in/out? My first look at
> *.log files only shows files that are locked in use.
>
> What I am really looking for is log files that record user activity in
> more detail, but login/out is a start. TIA.
Hi

If you enable auditing of logon events, you will find entries for
logons and logoffs in the security event log.

Auditing of logon events has to be enabled on the computer via Local
Security Policy or possibly domain level if in a domain. Then you can
search the security log for the following events:

Interactive logon: Event ID 528 containing Logon Type 2
Interactive logoff: Event ID 538 containing Logon Type 2


HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.m...
!