event log question

[TekChik]

yes, i posted it in OS's, but it takes forever to get responses in other parts of the forum, sadly.

anyway, i'm not a Windows expert by any means and i need to know if you can tell when someone is logging in/out of their machine by looking at the event log.

if so, how?

thanks,
TekChik

:wine:

 

[scauffiel]

Yeah, I'm not sure what OS you're using, but do a search on 'auditing' or 'audit' and it should hook you up with what you need.

S.

 

[TekChik]

Originally posted by: scauffiel
Yeah, I'm not sure what OS you're using, but do a search on 'auditing' or 'audit' and it should hook you up with what you need.

S.

sorry...should've included that:

Windows 2000 (server/workstation - i'll assume it's the same for both)

 

[TekChik]

come on...i know you guys know this stuff...LOL

 

[scauffiel]

Ummm, did you look it up in your Help? You should be able to go into Admin Tools, and select "Local Security Settings" and then drill down into "Local Policies" and then into "Audit Policy". Double click on "Audit account logon events" and/or "Audit Logon Events" and select both check boxes for success and failure. If this is on a network, then it's a bit different.

S.

 

[FoBoT]

as scauffiel says, the answer is "yes, if you turn that on"

 

[TekChik]

Originally posted by: scauffiel
Ummm, did you look it up in your Help? You should be able to go into Admin Tools, and select "Local Security Settings" and then drill down into "Local Policies" and then into "Audit Policy". Double click on "Audit account logon events" and/or "Audit Logon Events" and select both check boxes for success and failure. If this is on a network, then it's a bit different.

S.

yes, i did that, actually. now it's auditing logONs...but not logOFFs. it's on a network.

 

[FoBoT]

i think the number of logoff's should equal the number of logon's , kinda like a submarine, the number of surfaces should equal the number of dives

 

[TekChik]

Originally posted by: FoBoT
i think the number of logoff's should equal the number of logon's , kinda like a submarine, the number of surfaces should equal the number of dives

yeah, i get that. but...i've logged off and then back on 3 times now and there are only 3 entries and they correspond to the my logON times...but no logOFF.

 

[scauffiel]

What if you turn on auditing for 'system events'? Does that show logoffs?

S.