Event viewer interpretation (Logon/Logoff)

[rwilliams3]

I have been asked by management to provide a report displaying when users logon in the morning and logoff when they are leaving.

I've looked in the Event Viewer/Security Log and identified event ID 540 as Logon & 538 as Logoff, but there are multiple instances for each?

For example, I see event ID 540 for user:Wilber$ logging in at 7:49 am, 8:14, 8:28, 8:44, etc...

Same for event ID 538.

How can I best filter these extra entries out and create a useful report?

Thanks,

Russell

 

[InfrArch]

Please, review your GP/Auditing settings. Keep it on minimum. I'm sure , that you simply choosed more options than you actually need.

Victor K
psas@canada.com
MCSE+I;MCSA;MCSE(w2k);CNE(5.1);MCNE(6);CIWSP;CIWSA;Net+

 

[GlenJohnson]

I had a consultant turn off ALL security auditing and can't figure out how to start it up again. Boss has so much faith in the company, he doesn't want me to ask them. Claims if they said we didn't need it, we don't. Glen A. Johnson
Johnson Computer Consulting
MCP W2K
glen@johnsoncomputers.us

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884
"Doubt is not a pleasant condition, but certainty is an absurd one."
Voltaire -born Francois-Marie Arouet- (1694-1778); French writer.

 

[Davetoo]

Glen,

Ouch! Turned it all off? As much as I'd love not to have to wade through the logs every morning, I'd sure hate not to have them when something went wrong!

Audit policies are set under Domain Security Policy/Local Policies/Audit Policy.

Dave

 

[rwilliams3]

In Domain Security Policy/Local Policies/Audit Policy I have two items logging Success/Failures. They are:
1. Audit account logon events
2. Audt logon events

What's the difference?

What's the best way to view the data? Filter, then export to csv? How 'bout a third-party program to automate it?

RW

 

[doomhamur]

different services can create a logon event when they authenticate to the server, you just want success/failure on account logon and failure on longon events Doomhamur
Network Engineer
"Certifications? we dont need no stinking certifiaction."
yahoo IM handle: greater_vortex