How to audit JUST user logons? 1

[sqlhotdog2005]

In event viewer > Security on a PDC, is there a way to just log (either success or failure) of user logons to that domain? Since we have Symantec and BackupExec logging on as an administrator account, I think that is causing our event log to list many, many (successul) logon attempts.

We would like to just log when a user logs on, either successfully or unsuccessfully, from their workstation the the domain controlled by the PDC.

In addition, we would like to log when someone does the same thing sitting directly at the PDC.

Is there a way to do this?

 

[pancake]

Not sure through the event viewer. The way we do it is by having a login script that does the following.

echo %date%, %time%, %username%, %computername% >> "\\Servername\sharename\ITlog.txt"

gives you something like this

30/01/2006, 12:47:47.42, Administrator, COMP0002
30/01/2006, 12:47:59.60, 001042, FIN0034

This is a lot easier to interrogate than the event log.

You could add in other elements such as USERDOMAIN or LOGONSERVER

Won't catch an unsuccessful attempt though as the script runs after authentication :-(

 

[sqlhotdog2005]

Got it... sometimes the old-fashioned way works just as well... thanks for the tip.