identifying users behavior on windows 2008 server

[Techknowledge]

I am using Windows 2008 server and have setup a domain working-group environment. I have users and computers connecting (joined) to my domain. How do I using Windows 2008 server find out the following:

1) The time the user and/or computer logged in and logged out of the network.

2) The kind of activities the user/computer accessed and did during the time it was on a network.

3) How do I map a user to a computer.

4) The IP address allocated for a user in a network during the time of access (being live or offline)

Is this possible and how?

 

[imagoon]

I am using Windows 2008 server and have setup a domain working-group environment. I have users and computers connecting (joined) to my domain. How do I using Windows 2008 server find out the following:

1) The time the user and/or computer logged in and logged out of the network.

2) The kind of activities the user/computer accessed and did during the time it was on a network.

3) How do I map a user to a computer.

4) The IP address allocated for a user in a network during the time of access (being live or offline)

Is this possible and how?

1) turn on auditing and go through the event log
2) A Windows domain does not provide you with "user monitoring" the most you can see is log on times and file access if you turn enough auditing on. It won't tell you things like surfing habits or what applications are running.
3,4) The closest you can come is to matching the logins to the machine name and using that to look up the DHCP entry. I guess you could turn on logging if you really wanted to dig through it all to match everything up but this is user intensive and there are better tools to do this.

 

[Techknowledge]

Excellent. Where is the auditing turned on from.

 

[imagoon]

Excellent. Where is the auditing turned on from.

It varies based on what you are auditing. I would google it depending on what you are concerned about.

Users are in the domain policy, file systems are done in the file system tabs etc.