General discussion

  • Creator
    Topic
  • #2296800

    auditing

    Locked

    by iabforu ·

    Hello
    I am using windows 2000 professional (Personal Computer).
    How can i audit these events
    User logon
    user logoff
    restart and
    shutdown
    Enabling the audit policies it only audits user logon (event ID 528)

    I want to track that “how much (time) a user uses the computer
    in a day.Any thing else that can be used, any tool (3rd party )

    Please Help me.
    Thanks.

All Comments

  • Author
    Replies
    • #2673250

      Reply To: auditing

      by kozmo ·

      In reply to auditing

      go into the control panel and select the administrative tools icon and in there select the local security settings icon. you can now activate additional logging for example .. click on local policis and than audit policy. on the right you will see “Audit account logon events” double click it and put a check into sucess and failure. You can do this on any action you want audited. Remember the more you audit the more resources you use on the machine.

      • #2671784

        Reply To: auditing

        by iabforu ·

        In reply to Reply To: auditing

        I had tried both options

        audit account logon events
        audit logon events

        it only audits

        success/failure category account logon (for 1st policy)
        success/failure category logon/logoff (for second policy) but only tells about user logon

      • #2671783

        Reply To: auditing

        by iabforu ·

        In reply to Reply To: auditing

        I had tried both options

        audit account logon events
        audit logon events

        it only audits

        success/failure category account logon (for 1st policy)
        success/failure category logon/logoff (for second policy) but only tells about user logon

Viewing 0 reply threads