Auditing Successful Logins

Archived from groups: microsoft.public.win2000.security (More info?)

1 of our managers wants to know when (and which) employees logon before 8a.m.
Can the logs be set to only record successful logons for a given time
period? I don't want to log all successful logons - - way too much data to
soft through.
2 answers Last reply
More about auditing successful logins
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    You can not audit selectively for account logon or logon events. The logs
    are sorted by time and you can use tools like Event Comb to make searching
    through the security logs much easier. There are free third party command
    line tools that allow you to dump event logs to meet certain criteria such
    as PsLogList. --- Steve

    http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 --- Event
    Comb
    http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml
    http://www.microsoft.com/technet/scriptcenter/scripts/logs/eventlog/default.mspx
    -- vbscipts for managing logs

    "IanBHendry" <IanBHendry@discussions.microsoft.com> wrote in message
    news:1874BD1C-A37A-40B4-BCB5-F45FBD475A2B@microsoft.com...
    >1 of our managers wants to know when (and which) employees logon before
    >8a.m.
    > Can the logs be set to only record successful logons for a given time
    > period? I don't want to log all successful logons - - way too much data
    > to
    > soft through.
  2. Archived from groups: microsoft.public.win2000.security (More info?)

    You can create an event collection rule in MOM to only collect specified
    events with-in or out of a specified time range. This also centralizes the
    data in SystemCenter reporting for more comprehensive analysis and reporting.

    The Manakoa System Controls MP provides a rule template that specifically
    addresses this scenario. It also contains comprehensive event collection and
    reporting services for similar types of compliance auditing activities.

    For more information regarding the MP check out the link below.

    http://manakoa.com/products/scmp/index.php

    Jeremiah

    "IanBHendry" wrote:

    > 1 of our managers wants to know when (and which) employees logon before 8a.m.
    > Can the logs be set to only record successful logons for a given time
    > period? I don't want to log all successful logons - - way too much data to
    > soft through.
Ask a new question

Read More

Security Microsoft Windows