General discussion

Locked

auditing

By iabforu ·
Hello
I am using windows 2000 professional (Personal Computer).
How can i audit these events
User logon
user logoff
restart and
shutdown
Enabling the audit policies it only audits user logon (event ID 52

I want to track that "how much (time) a user uses the computer
in a day.Any thing else that can be used, any tool (3rd party )

Please Help me.
Thanks.

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by Kozmo In reply to auditing

go into the control panel and select the administrative tools icon and in there select the local security settings icon. you can now activate additional logging for example .. click on local policis and than audit policy. on the right you will see "Audit account logon events" double click it and put a check into sucess and failure. You can do this on any action you want audited. Remember the more you audit the more resources you use on the machine.

Collapse -

by iabforu In reply to

I had tried both options

audit account logon events
audit logon events

it only audits

success/failure category account logon (for 1st policy)
success/failure category logon/logoff (for second policy) but only tells about user logon

Collapse -

by iabforu In reply to

I had tried both options

audit account logon events
audit logon events

it only audits

success/failure category account logon (for 1st policy)
success/failure category logon/logoff (for second policy) but only tells about user logon

Back to Windows Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums