User Logon ID

Archived from groups: microsoft.public.win2000.security (More info?)

I would like to record User, Computer, and Logon time for each user loging
into our W2K, single DC, server. Something like "net sessions" but recording
just the logon times. The Security Event Viewer seems to capture multiple
events when I ask for "success audit of Logon/Logoff" events. My ultimate
objective is to create a managment report with just the essential logon
identification information.
1 answer Last reply
More about user logon
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    Logging onto the domain or just the domain controller?? If you want to audit
    all user logons to the domain then enable auditing of "account logon events"
    in Domain Controller Security Policy. For logons to just the domain
    controller enable auditing of logon events in Domain Controller Security
    Policy. It is the nature of Windows auditing to record a lot of apparently
    multiple identical events for logons [don't ask me why]. There is no built
    in quick and easy way to generate nice concise reports. You may want to look
    at a third party program like S.E.L.M. as shown at the link below. They
    offer a free trial of it.--- Steve

    http://www.gfi.com/lanselm/

    "jimtotem" <jimtotem@discussions.microsoft.com> wrote in message
    news:158D1957-BBDD-4839-8CF7-6475B0C212D2@microsoft.com...
    >I would like to record User, Computer, and Logon time for each user loging
    > into our W2K, single DC, server. Something like "net sessions" but
    > recording
    > just the logon times. The Security Event Viewer seems to capture multiple
    > events when I ask for "success audit of Logon/Logoff" events. My ultimate
    > objective is to create a managment report with just the essential logon
    > identification information.
Ask a new question

Read More

Security Events Windows