Sign in with
Sign up | Sign in
Your question

Auditing Successful Logins

Last response: in Windows 2000/NT
Share
Anonymous
a b 8 Security
May 31, 2005 8:23:36 PM

Archived from groups: microsoft.public.win2000.security (More info?)

1 of our managers wants to know when (and which) employees logon before 8a.m.
Can the logs be set to only record successful logons for a given time
period? I don't want to log all successful logons - - way too much data to
soft through.
Anonymous
a b 8 Security
May 31, 2005 10:47:58 PM

Archived from groups: microsoft.public.win2000.security (More info?)

You can not audit selectively for account logon or logon events. The logs
are sorted by time and you can use tools like Event Comb to make searching
through the security logs much easier. There are free third party command
line tools that allow you to dump event logs to meet certain criteria such
as PsLogList. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 --- Event
Comb
http://www.sysinternals.com/ntw2k/freeware/psloglist.sh...
http://www.microsoft.com/technet/scriptcenter/scripts/l...
-- vbscipts for managing logs

"IanBHendry" <IanBHendry@discussions.microsoft.com> wrote in message
news:1874BD1C-A37A-40B4-BCB5-F45FBD475A2B@microsoft.com...
>1 of our managers wants to know when (and which) employees logon before
>8a.m.
> Can the logs be set to only record successful logons for a given time
> period? I don't want to log all successful logons - - way too much data
> to
> soft through.
Anonymous
a b 8 Security
June 13, 2005 3:01:04 PM

Archived from groups: microsoft.public.win2000.security (More info?)

You can create an event collection rule in MOM to only collect specified
events with-in or out of a specified time range. This also centralizes the
data in SystemCenter reporting for more comprehensive analysis and reporting.

The Manakoa System Controls MP provides a rule template that specifically
addresses this scenario. It also contains comprehensive event collection and
reporting services for similar types of compliance auditing activities.

For more information regarding the MP check out the link below.

http://manakoa.com/products/scmp/index.php

Jeremiah

"IanBHendry" wrote:

> 1 of our managers wants to know when (and which) employees logon before 8a.m.
> Can the logs be set to only record successful logons for a given time
> period? I don't want to log all successful logons - - way too much data to
> soft through.
!