monitor users

[bookouri]

Is there any way in 2000 server to monitor user "useage" I want to be able to tell when a user has logged on, when they logged off, the logon workstation etc.

I though there might be a way to have 2000 log these events, but I cant remember.

thanks for any info

 

[bsv]

Check out the URL below, it should help you out quite a bit. It is a fairly comprehensive explanation of how to audit account activity. Skip over section 2, unless you want to learn how Windows 2000 does authentication.

http://rr.sans.org/win2000/audit_w2k.php

- BSV


IF THE AUTOMOBILE INDUSTRY HAD EVOLVED THE WAY THAT THE COMPUTER INDUSTRY DID, A ROLLS- ROYCE WOULD COST $100, GET A MILLION MILES TO THE GALLON, AND EXPLODE ONCE A YEAR KILLING EVERYONE INSIDE. – AUTHOR UNKNOWN

 

[mparra]

This is great info.... thanx

Marcello

http://www.telatrend.com

 

[bsv]

I'm glad to hear it helped.


- BSV


IF THE AUTOMOBILE INDUSTRY HAD EVOLVED THE WAY THAT THE COMPUTER INDUSTRY DID, A ROLLS- ROYCE WOULD COST $100, GET A MILLION MILES TO THE GALLON, AND EXPLODE ONCE A YEAR KILLING EVERYONE INSIDE. – AUTHOR UNKNOWN

 

[bookouri]

thanks for the info... it does make a great reference document.

I tried logging logon events, but for some reason I can not seem to get it started. I've done it before on a stand alone server and had no problem. I dont know of any further steps required to make my DC work. I went into Active Dir Users, Group Policy, Default Domain Policy, Computer settings, Security, etc... I turned loggin of successful and unsuccessful logons and (what's the new win2k... Domain Logons? anyway there are two now) I turned on the logging at the Primary DC, but no logging is taking place.. I must have missed something somewher, but I just dont know where...

 

[bookouri]

One thing not mentioned in any of the documentation I found was that on your domain controller there is a DOMAIN CONTROLLER SECURITY POLICY that you have to use to set the logon/logoff events. If you set them in the default domain policy they are not logged on the domain controller. IF you set them on the domain controller's machine security policy they wont be logged... it MUST be set in the domain controller security policy...