Audit Logons

[LLudlow]

Hi,

I have a windows 2000 Advanced server with about 100 client computers. It has been brought to my attention that a user is logging into his workstation using someone else's username and password. I am looking for a way to find out exactly when this user does this. I have looked through the various policies but I am unsure which one does this for me. Also I would like it to be e-mailed to me when ever a user loggs into this particular workstation. I hope someone can help.

Thanks

 

[koquito]

You can use audit policies for any user A+, MCP, CCNA
marbinpr@hotmail.com

Keep fighting for your knowledge!

 

[LLudlow]

But can you place an audit policy on just a specific workstation?

 

[koquito]

you dont do any audit policies to workstations, just to events on that workstations.In the event log (security), it tells you on what computer the event ocurred. IF you audit a user log on for example, the log can tell you at what time, on what workstation, etc it ocurred A+, MCP, CCNA
marbinpr@hotmail.com

Keep fighting for your knowledge!

 

[imatthec]

If your client comnputers are win2k/xp, you can enable auditing on a single workstation as long as your domain's group policy does not over ride it.