Logging logon attempts

[tbalazs]

Win2k server (domain controller) XP pro workstations.
What is the simplest way to log logon attempt events to one particular workstation? Logons would probably be as administrator. Could local logon attempts be logged as well, or only logons to the domain?
Thanks,
Tony.

 

[wdoellefeld]

Here is some poor man's logging that I use. VB script that I call from my login script.

On error resume next
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objNetwork = CreateObject("WScript.Network")
strPCName = objNetwork.Computername
user = objNetwork.UserName

Set oshell = CreateObject("wscript.shell")
strWinDir = oShell.ExpandEnvironmentStrings("%SYSTEMROOT%")

varDate = Month(Date()) & "-" & Day(Date()) & "-" & Year(Date())
Set objText = objFSO.OpenTextFile(strWinDir & "\Auditing.txt", 8, True, 0)
ObjText.WriteLine("Logon" & vbtab & varDate & vbtab & time & vbtab & User & vbtab & vbtab & strPCName)
ObjText.Close
Set objText = nothing
Set oshell = nothing
Set objNetwork = nothing
Set objFSO = nothing

wscript.quit

FRCP

http://www.frcp.net

(my side business)

 

[WhoKilledKenny]

You can log local attempts, just set up auditing on each of the servers you want to monitor. It will log the info in the local security log.