How to make LOGON/LOGOFF events appear on the DC?

Archived from groups: microsoft.public.win2000.security (More info?)

We would like to see LOGON/LOGOFF events that appear on the DC so that
we can write a .NET program to calculate how long the users have been
logged in. This program together with a MUST LOGOFF employee policy
will help bust those employees who don't punch clocks and enjoy free
afternoons off when their bosses are out of town.

My head is thoroughly spinning after all the replies for people
requesting the differences between "Account Logon Vs. Logon Events",
etc.

We would *really* appreciate if someone could present the detailed
steps involved in making these events appear. We are with a Domain
Controller and 50 users. Thanks. -Jeff
1 answer Last reply
More about make logon logoff events
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    That is going to be difficult as domain controllers will record when a user
    logs on when "account logon" events are enabled in Domain Controller
    Security Policy, but not logoffs. To get logoff events you will have to
    enable auditing of "logon events" on domain computer either in Domain
    Security Policy or Local Security Policy and then check the security logs of
    the domain workstations for logon and logoff events for the user for type 2
    interactive logon. Event Comb can be used to harvest events on network
    computers to a common text file log. --- Steve

    http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 -- Event
    Comb

    "Jeff Gottlieb" <info@wolfcg.com> wrote in message
    news:1106637601.817975.53010@c13g2000cwb.googlegroups.com...
    > We would like to see LOGON/LOGOFF events that appear on the DC so that
    > we can write a .NET program to calculate how long the users have been
    > logged in. This program together with a MUST LOGOFF employee policy
    > will help bust those employees who don't punch clocks and enjoy free
    > afternoons off when their bosses are out of town.
    >
    > My head is thoroughly spinning after all the replies for people
    > requesting the differences between "Account Logon Vs. Logon Events",
    > etc.
    >
    > We would *really* appreciate if someone could present the detailed
    > steps involved in making these events appear. We are with a Domain
    > Controller and 50 users. Thanks. -Jeff
    >
Ask a new question

Read More

Events Microsoft Windows